#ben dorr

Context

“Since April 15, protests against coronavirus lockdown measures have been sweeping across various American states. ... over 500 new domains related to the protests have been registered in the past month.”

“The largest number of them were created just hours after President Trump sent a series of all-caps tweets urging citizens to ‘liberate’ themselves from new gun control measures and state leaders who’ve enacted strict social distancing restrictions in the face of the COVID-19 pandemic.”

Suspicion

“A number of the state-based reopenmn[.]com or reopenmd[.]com domains were all registered on GoDaddy at the same time and within seconds of each other. This led them to suspect that the reopen America protests were not a grassroots campaign, but actually a coordinated astroturfing—or fake grassroots—effort.”

Research and Confirmation

According to DNS-focused cybersecurity firm DomainTools:

“By gathering domain names that include the same words, and by analysing the domains for other similarities, DomainTools was able to determine that many of them ‘redirect to a state-based firearms coalition group.’ ... these groups tie back to Aaron Dorr, a registered lobbyist for the state of Iowa. ... the ‘reopen’ websites linked to Aaron Dorr bear various similarities, including the fact that they were built using nonpartisan advocacy platform One Click Politics and also WordPress. By looking at one of them, the Iowa Gun Owners website, DomainTools was able to find Dorr’s telephone number. DomainTools then examined the historical SSL certificates used for each of the firearms advocacy domains, finding Mr. Dorr’s personal domain and also numerous other domains associated with other firearm’s coalitions elsewhere in the US. ... this ‘raised the likelihood for us that Mr. Dorr was the one running these campaigns.’ In other words, a batch of the ‘reopen America’ domains are the work of a single gun advocacy network.”

The full analysis from DomainTools is here.