US seizes more domains with ties to suspected Iranian influence campaign

The U.S. Department of Justice’s actions against alleged Iranian influence campaigns continued this week with the seizure of 27 internet domains, including four that the feds say were targeted directly at U.S. audiences.

Iran’s Islamic Revolutionary Guard Corps (IRGC) unlawfully used the domains in operations to “covertly influence” opinions in the U.S. and elsewhere, the department said in an announcement Wednesday. In early October, the feds seized 92 domains under similar allegations. Later that month, the Treasury Department sanctioned five Iran-linked organizations for spreading disinformation and making other attempts to sow discord in the U.S.

As with previous announcements, U.S. officials cited help from Silicon Valley giants.

“Thanks to our ongoing collaboration with Google, Facebook, and Twitter, the FBI was able to disrupt this Iranian propaganda campaign and we will continue to pursue any attempts by foreign actors to spread disinformation in our country,” said FBI Special Agent in Charge Craig Fair.

This week’s announcement does not mention the 2020 U.S. elections, nor did the Justice Department’s Oct. 8 statement about the previous domain seizures. The law enforcement actions come, however, as the U.S. presidential election remains undecided and federal agencies are on high alert for foreign meddling and misinformation as several states are counting votes.

The Oct. 22 Treasury sanctions announcement did cite election interference. It came the day after U.S. intelligence agencies assessed that threatening emails sent to Florida voters had originated in Iran. A week later, federal officials said Iranian hackers had probed the election systems of at least 10 states.

All 27 domains in the latest takedown were “registered with U.S.-based domain registrars and used top-level domains owned by U.S.-based registries,” according to the Justice statement, making them subject to several U.S. laws that restrict Iran’s economic activity in the U.S., including the International Emergency and Economic Powers Act and the Iranian Transactions and Sanctions Regulations.

DOJ said the four domains allegedly aimed at U.S. audiences — rpfront.com, ahtribune.com, awdnews.com and criticalstudies.org — were in violation of the Foreign Agents Registration Act, a transparency law that governs the political activities of representatives of foreign entities in the U.S.

In a separate affidavit, the FBI said the domains had connections to the Liberty Front Press network, an alleged influence campaign that was first outed in 2018 by cybersecurity company FireEye.

U.S. officials continue to urge vigilance as the election results are still coming in. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency is running a “rumor control” page for debunking misinformation.

The Iranian regime’s interest in digital influence and espionage operations extends well beyond the U.S. Cybersecurity researchers recently linked Iran to spearphishing emails sent to large swaths of potential attendees of the Munich Security Conference as well as the Think 20 Summit in Saudi Arabia.