A research group at the University of Toronto has untangled look-alike websites and bogus news articles with possible links to Iran

By Scott Shane & Ronen Bergman @ NYTimes.com, May 14

LOS ANGELES — Ali Al-Ahmed is a veteran critic of the Saudi government, so late last year he was not surprised to receive a Twitter message purporting to be from an Egyptian woman living in London who said that she, too, was a Saudi opponent. But Mr. Al-Ahmed, who is based in Washington, was wary of the woman, who identified herself as Mona A. Rahman. “Her picture was too made up, like the picture of a model,” he recalled. Her Arabic was imperfect. And her messages in Arabic included a character that indicated that she was typing on a Farsi-language keyboard.

Then she sent him an article that appeared to be from the website of the Belfer Center for Science and International Affairs at Harvard about an unexpected development in Israeli politics. The article was on a site that had the exact logo, coloring and layout of the Harvard site. But the address was “belfercenter.net” — not the real one, “belfercenter.org.” And the article, claiming the Israeli defense minister had been fired for being a Russian agent, was a total fabrication.

Mr. Al-Ahmed had encountered what a new report from Citizen Lab, a research group at the University of Toronto, says is a pro-Iranian influence operation that used elaborate look-alike websites and social media to spread bogus articles online and to attack Iran’s adversaries. The operation had another innovative maneuver: When the invented reports were picked up by mainstream news organizations, the operators quickly took down the fabrications to make it harder to track the fraud. “They deleted their fake stories once they achieved some buzz,” said Gabrielle Lim, a fellow at Citizen Lab and a lead author of the report. “This made it hard for regular users to figure out what was happening, and hid the original source of the disinformation.” [.....]