If this was a detective novel it would have been the point where the hero and his trusty sidekick know there must be a single shadowy underground organization behind the recent string of heists in the city but they still have no clue who the villains are. They would be sitting at the police station going over the available evidence and crime scene photos again and again, lamenting about the lack of clear fingerprints and muttering things like "These guys are good" or "Definitely a professional".
"Another new site? Anonymously registered? Damn, these guys are good!"
And then suddenly some mystery woman would turn up with the one vital clue that had escaped their attention and the whole case would crack open like a nut...
"Hi. I'm Jesica. My name does not end in a number."
In our case the first message that would lead to the vital clue arrived in the form of an automated email notification from the Trendolizer software we were using to track the network. A new site named coolinfo24.com had just gone live and Trendolizer noticed it was using the same Adsense advertising account code as several other sites in the network.
Just like we would expect several Twitter accounts masquerading as young, attractive women were already hard at work spreading links to it:
'Hi. Our names are Jesica too!'
And then it struck us: one of these was not like the others. The sixth account also had a female avatar but a weird name: @dapcevski - it didn't end in a number. And "she" was much older than the rest:
The photo is actually Serbian singer Sandra Afrika's current Facebook and Twitter profile picture.
But wait! The Google cache revealed "Jesica" was not always a woman. She used to go by "dapcevski" in 2016 and her profile avatar used to be some kind of shield with the letter "M" in it.
A Google images search for "dapcevski" revealed what was probably the missing image in the January 14 post and also revealed a link to the page of a pyrography (wood burning) artist from Kumanovo, Macedonia on Facebook.
Another Google search revealed someone named "Saso Dapcevski" had left a comment on that page at some time:
Someone going by that name used to have a Google+ profile using the exact same avatar:
And clicking that avatar revealed that the M-in-a-shield was a big tattoo on someone's shoulder:
And look: there's a Saso Dapcevski on Facebook who happens to have that exact same tattoo!
His wife posted this holiday snap in 2015, exactly the same image that appeared as the first result in the Google Images search results for "dapcevski", revealing it was also present at one time on the @dapcevski Twitter account (where it now seems to have been removed) thus proving the connection:
Not only that: the Facebook account was already used all the way back in 2017 to spam links to libertymagazine.net, another site from the network:
Mr. Dapcevski seems to be part of several groups for truckers and drivers on Facebook:
He was also seen posing next to several trucks at what seems to be a picnic at what looks like some kind of truck stop in Germany:
An expert in Slavic languages we contacted also pointed out that "tamche", as in the domain name "tamche1966.com" used by one of the sites in the network, apparently can mean "van" or "small truck" in Macedonian/Serbian when it is spelled as "tamče" (TAM is a local company that used to make trucks and busses, "tamče" is a term of endearment like "little"; as if a Swedish trucker called his rig "my little Volvo"). And Mr. Dapcevski does look like he could be born in 1966.
Tamche1966.com & the TAM logo
So we finally had a lead! With renewed enthusiasm we started looking into who else was spreading links to sites in the network using a variety of other tools and techniques and we found out Dapcevski was just one node in a much larger network.
In the end we uncovered several groups of related people from the town of Kumanovo in Macedonia who were all involved in some way, along with several fake Facebook profiles and a big list of Facebook pages and Groups that were used to seed links to articles from their websites. Using Facebook Messenger, we sent Mr. Dapcevski a message and with the aid of an interpreter, we called him for comments. At first, he said he wanted to answer some questions, but before we could ask them, he hung up on us.
It would have been the perfect crime if it hadn't been for Jesica and her tattoo... and the mile-wide trail of other clues we eventually discovered. You can read all about that here.
Image credits:
