New from me: Racist Disinformation Campaign Impersonates Tammy Duckworth. Handful of accounts have been using a forged letter from Duckworth's office to falsely claim that "black separatists" were responsible for the Bonhomme Richard Navy ship fire. https://www.thedailybeast.com/tammy-duckworth-impersonated-in-racist-disinformation-campaign?ref=home

The accounts involved impersonated Yoni Chetboun, an Israeli special operations Lt Col who went on to serve in the Knesset, and a nonexistent reporter for France24. They've since been suspended from Twitter.

Dig through those two accounts' histories, you'll see they set up copycat websites to push their stories. The "Kelly Turner" account linked to a fake article about the Bonhomme fire lphinfo/.org, a website meant to resemble a real Israeli weekly hosted at http://lphinfo.com 

The only content on that fake domain is one article about the fake "black separatists" starting the Navy fire story formatted to look like the real Hebdo website. If you click anywhere on the fake website, it immediately redirects you to the real website at .com

Here's what it looks like when you open the fake article and click anywhere. Fairly visually seamless transition from fake to real. Only thing you see is the switch from .org to .com.

The "Kelly Turner" account pulled this trick with two other spoofed news sites. It linked to a fake copy of http://nouvelobs.com  hosted at .org for a story about how Iraqi PM Mustafa Kazemi was 'secretly under the protection of Saudi Arabia, the US, and UK.

Another fake domain spoofed http://Laprovence.com  with a misspelled version ("laprovnce"). That one ran a fake interview with Israel's Ambassador to France and Monaco, Aliza Bin-Noun. In the fake interview, the phony Amb. Bin-Noun announces Mossad support for the MEK

To be clear: we don't know who's behind this and behavioral evidence is insufficient for attribution. But suffice it to say that these accounts were interested in lots of themes—MEK, Iraq, Israel—you often see in Iranian disinfo networks.

Context is interesting. On the same day these accounts tweeted their fake Duckworth letter, the head of the Qods Force gave a speech echoing the theme in it—that the Bonhomme Richard attack was some sort of insider attack (it wasn't) https://twitter.com/Tasnimnews_EN/status/1283080658089316354

Former editor of the IRGC-linked Tasnim news also encouraging the fake insider attack conspiracy https://twitter.com/abasaslani/status/1283053746486947843?s=21

NYT reported that US & Israel have embarked on a covert sabotage campaign in Iran. Explosions at nuke facilities, fires in Iranian ports blamed on saboteurs. In response, IRGC-linked media have been trying to encourage conspiracy theories about the sabotage in the US

There was a fire at an Indiana steel plant last week. Boring old accident. No injuries. Now see how Iran twitter is covering it https://twitter.com/search?q=%D9%81%D9%88%D9%84%D8%A7%D8%AF%20%D8%A7%DB%8C%D9%86%D8%AF%DB%8C%D8%A7%D9%86%D8%A7&src=typed_query&f=live

As an aside, we saw a similar piece of disinfo try to spoof @FPRI back in January (full disclosure: I'm a fellow there). Back then someone created a copy of the FPRI website at a different domain and hosted a fake interview with an FPRI fellow in Arabic.

The fake interview was supposedly about how the US planned to expel Shiites from power in Iraq. Similar tactic & theme from this group. Kelly Turner account forged a screenshot from a real reporter's Twitter to claim Bolton had said Trump admin considered launching a coup...

...in Iraq in order to deprive Iraqi Shia of political power.

In any case, it certainly looks like Iran is trying to paper over its vulnerability to covert sabotage by spinning any accident in the US as the result of something similar. That's the context in which the attempted disinformation campaign about the Navy ship fire is happening