The Kumanovo-connection: Macedonian Spam Clans Still Make Money With Fake News About Muslims and Migrants

Fact Check

  • by: Maarten Schenk
The Kumanovo-connection: Macedonian Spam Clans Still Make Money With Fake News About Muslims and Migrants

A Macedonian military man appears to be one of the driving forces behind a network of fake news websites that reached millions of people with articles often inciting hatred against muslims and migrants. Together with friends and family he has been spreading his messages via Facebook and Twitter. Sometimes under their own names, sometimes using fake identities. A look behind the scenes of the spam clans of Kumanovo.

By Peter Burger & Maarten Schenk

On December 7, 2018 U.S. soldier Jony Smith from Newark posts a link on a Facebook group named "Judge Jeanine Pirro Fans". Jeanine Pirro is a former judge now with her own show on Fox News. She is popular with Trump supporters and this Facebook fan page has over 53,000 members. Jony's link points to an article on an obscure little website named tvrtinfo.com. The news: a former British secret agent has confessed on his deathbed that he murdered Pricess Diana at the orders of Prince Philip, Queen Elizabeth's husband.

The story is fake: it was made up by the infamous American website YourNewsWire.com. The picture dates back to 2010 and shows a patient in an Australian hospital. Jony Smith is fake too. But he is an actual military man: 'Jony Smith' is one of the alter-egos of Slagan Cago Bojkovski from Kumanovo, Macedonia, who actually works for the Macedonian Army but who also moonlights as the manager of a fake news factory. Until a few days ago, his Facebook profile listed his employer and on his own profile picture which he uploaded in December he is wearing a camouflage uniform with a Macedonian flag patch.

Left: Jony Smith. Right: Slagan Cago Bojkovski.

Tvrtinfo.com, the site linked to by 'Jony Smith', is part of a network of junk and fake news websites we wrote about before. We knew they were spreading hoaxes using fake Twitter accounts and also that they were reaching a huge audience: using only two sites they reached a potential audience of 3.6 million Facebook users in only two weeks.

One article even made BuzzFeed's top-50 overview of the biggest hoaxes of 2018: 'Muslim Figure: "We Must Have Pork-Free Menus Or We Will Leave U.S." How Would You Respond This?' One hundred percent fake but enough to get over 630,000 reactions, shares and comments on Facebook.

We now know the operators of the network created over 70 websites since 2016 and that they got millions of reactions, comments and shares on Facebook with them and a slew of retweets on Twitter. The total runs to 7.16 million to be exact. To read more about the reach of the network you can read this other article:

Decline and Fall Of A Macedonian Fake News Network: Numbers Indicate Facebook's Measures Forced Desperate Move To Twitter | Lead Stories

Although Macedonian fake news merchants still generate thousands of Facebook likes and shares, the platform's recent measures against bad actors have drastically reduced their reach. The next step in the arms race takes the battle to Twitter.

In comparison: a fact checking site like Snopes gets 8.8 million in a year and needs 5,687 articles for it and a big, professional crew of editors and journalists. The Kumanovo-network consists of just a handful of part-timing amateurs and about fifteen different spammers over time who helped spread links on Facebook. Then again when you steal most of your content you don't need to bother with writers or editors much.

Who is behind this successful enterprise? It turns out they were not the proverbial teenagers who rode to world fame after the 2016 revelations that appeared about Macedonian fake news. The people behind this junk news business are adults with day jobs, often with the government, aided by family and friends.

One of Bojkovski's (Facebook) friends is Viktor Kolevski, also hailing from Kumanovo, who studied at the military academy in Skopje and who worked as a police inspector. His LinkedIn-profile says he still does but Kolevski let us know he has started working for himself at some point in time. He registered two of the domain names used by sites in the network and just like Bojkovski he pushed links to them in Facebook groups for Trump supporters. It appears they had a business relationship at some point: both registered websites that later shared the same Google Adsense ID, implying the ad revenue went into the same account.

Bojkovski and Kolevski aren't the only fake news entrepreneurs with military connections. Back in February of 2018 Lead Stories already discovered a different network of seven sites was run by officer Marjan Zlatanovski and his wife Mare Krsteva. After being outed Zlatanovski deleted his Facebook profile but a new one using Cyrillic spelling of his name appeared in the friend list of Kolevski.

That partners are involved is not a coincidence: in Macedonia the fake news trade is a family business..

Family business

Here's the business model in a nutshell: on their mostly anonymously registered websites the network's operators post clickbait articles that appeal to conservative Christians, Trump supporters, populists, conspiracy thinkers or even overt racists. They then "seed" this product on Twitter and Facebook with the help of friends and family, sometimes under their own name but also while using fake accounts. This draws a crowd to their website. Clicks turn into cash via ads shown through Google's AdSense ad network (or a similar service). That's how simple it is.

Most of the stories aren't written by the operators themselves: they are mostly copied from English-language sites ranging from conservative news outlets like Fox News to various conspiracy-ridden blogs. We suspect some stories were even stolen multiple times in a row by different websites from different networks copying from each other after they noticed a story working well for somebody else.

We could deduce this from all kinds of "mutations" showing up in different version of the same article over time (missing words or paragraphs, image captions becoming part of the article text, images getting replaced, bits of text getting duplicated...). Often these changes had little impact on how well the article did.

You don't need to be a computer genius to do all this. Most operators from the Kumanovo-network appear to be middle-aged Macedonians with no special internet marketing skills, judging by their personal profiles on social media. And even though the stories they post are politically very charged their motive doesn't seem to be politics. On Facebook they keep business (political clickbait) and private (family gatherings, selfies, internet wisdom, music videos) strictly separated. It's all about the money.

Another thing that doesn't conform to the stereotype of the savvy teenagers is the emphasis on family in this trade. The fake Twitter account of "Moly Anderson" (now deleted by Twitter) used to have pictures of Slagan Bojkovski and his wife Natasa as its avatar.

'Moly Anderson': fake account using a picture of Natasa and Slagan Bojkovski.

Natasa's face also graces other fake accounts, just like that of one of her close relatives.

Other relations of the Bojkovskis also consider spamming fake news a fun activity for the whole family. A woman from Veles (the town that rose to fame in 2016 as the capital of fake news) and her kin were happily promoting one of Slagan's sites in Facebook groups with names like 'VOTE TRUMP ONLY' and 'Swamp Drainer Disciples', each boasting between 30-40K members.

Toni and Mirjana Risteski from Kumanovo, Facebook friends with the Bojkovskis, ran their own site named unisharenews.com. Toni was the one who registered the site (which is no longer online) while Mirjana and their daughter promoted it. In 2017 Mirjana shared posts in Facebook groups like 'We Love President TRUMP' and 'THE TRUMPERS!!!' with clickbait headlines like 'Liberal Feminist Takes In Muslim Refugee For The Night, Wakes Up To Horrifying Surprise In Her Bedroom Hours Later'.

In the same circles we found a truck driver with a tattoo which eventually put us on the trail to find the key people in the network (read all about that here). He used his own name to dump truckloads of junk and fake news on Facebook and did the same while disguised as 'Jesica' on Twitter. And he wasn't the only fake Jesica we met.

68 Jessicas and other fake identities

On January 3, 2019 Jony Smith, a known sockpuppet of Slagan Bojkovski, posts a story from ludinfo24.com to the Facebook group 'Judge Jeanine Pirro Fans' (53,000 members). One minute later one 'Ema Brown' posts the same link to the group 'Deplorables for Trump' (18,000 members) and another minute later 'Lisa Sanders' puts it in 'Pauline Hanson's One Nation', a group for supporters of a right-wing populist politician from Australia (23,000 members). Ema Brown and Lisa Sanders are also Slagan Bojkovski sockpuppets.

Ema Brown studied at Skopje university according to her Facebook profile and 'works at Facebook'. Lisa Sanders is 'self-employed'. Ema's profile picture is stolen from Serbian singer Aleksandra Prijović, Lisa's belongs to Macedonian singer Viktorija Loba.

Two fake accounts that seeded Kumanovo-network posts in Facebook groups.

We counted about fifteen of these kinds of fake accounts in the friend lists of Bojkovski & co. Half of them haven't even been active yet, they are waiting in the wings until they are needed. The fact that they are interconnected with the real members of the Kumanovo clan (including young children) probably makes it harder for Facebook to detect them.

Still, recent measures by Facebook seem to be making an impact: in the past year the average reach per post of sites in the network has cratered (read our analysis of the reach numbers here). Kumanovo's fake news farmers are intensifying the planting and seeding of their crop on Twitter. And they are learning from their mistakes. Last year they tried to use small numbers of accounts to gain large follower bases so they could then spam many links to them. And it worked: the non-existent Lori Coutler sent out over 500 tweets and gained 11,000 followers in three months. But when Twitter suspended her account all that reach just evaporated.

The new strategy seems to be to create a few new accounts every day that only send out a handful of tweets and never gain more than a few hundred followers. Since last November over 450 fictitious women appeared on Twitter, including 68 Jessicas en 28 Jesicas (have a look at the list). They gained over 33,000 followers in a month-and-a-half and Twitter only removed ten of these fake accounts so far.

Slagan Cago Bojkovski's own Twitter account is still active too with a mix of authentic and fake. On Twitter he poses under his own name (@Slagan, screen name: Cago) as a Republican from Chicago with a passion for police dogs.

Slagan Bojkovski's Twitter account

The Macedonians react

We attempted to contact the members of the Kumanovo-network named in this story. We put our findings to them by email, Facebook Messenger and by phone with the aid of an interpreter. Viktor Kolevski only told us something about his job in a few words: even though his LinkedIn profile says he is a police inspector he claims he isn't anymore. Dapcevski, the trucker, was prepared to answer a question but hung up before it could be asked. The Risteskis, who ran their own little hate website unisharenews.com in 2017 did not reply to any of our questions.

Slagan Bojkovski initially denied having anything to do with fake news websites - he wouldn't even know how to make one. Later he admitted he used to have a site two years ago but that he quit, 'just like everyone in Macedonia anyway'.

Why would his own picture and that of his wife appear on fake Twitter profiles in that case? According to him someone else must have stolen his pictures. The false Facebook account of U.S. soldier Jony Smith he was Facebook friends with? He didn't know who we were talking about. And he himself didn't work for the army since one year anyway.

Before we called Bojkovski fifty of the seventy-five websites of the network were still active. A few hours after the call about forty of those went down, one after the other. (The remaining ones mostly had been inactive for several months already.) This massive vanishing act made over 3,500 sensational (SHOCKING! BREAKING!), scary (CIVIL WAR! PEDOPHILES!), inciting (RAPE! BURN! KILL!) and hateful (MUSLIMS! REFUGEES! MIGRANTS!) articles disappear from the internet.

Also fallen on the field of (dis)honor: the Facebook account of 'Jony Smith'.

The Kumanovo-connection Files

This investigation has been a coproduction of Nieuwscheckers and Lead Stories. A selection of these stories appeared on both sites - in Dutch and in English.

Nieuwscheckers published:

Following articles appeared on Lead Stories:

Image credit: Google Streetview

    Maarten Schenk

    Lead Stories co-founder Maarten Schenk is our resident expert on fake news and hoax websites. He likes to go beyond just debunking trending fake news stories and is endlessly fascinated by the dazzling variety of psychological and technical tricks used by the people and networks who intentionally spread made-up things on the internet.  He can often be found at conferences and events about fake news, disinformation and fact checking when he is not in his office in Belgium monitoring and tracking the latest fake article to go viral.

    Read more about or contact Maarten Schenk

    About Us

    International Fact-Checking Organization Meta Third-Party Fact Checker

    Lead Stories is a fact checking website that is always looking for the latest false, misleading, deceptive or inaccurate stories, videos or images going viral on the internet.
    Spotted something? Let us know!.

    Lead Stories is a:


    @leadstories

    Subscribe to our newsletter

    * indicates required

    Please select all the ways you would like to hear from Lead Stories LLC:

    You can unsubscribe at any time by clicking the link in the footer of our emails. For information about our privacy practices, please visit our website.

    We use Mailchimp as our marketing platform. By clicking below to subscribe, you acknowledge that your information will be transferred to Mailchimp for processing. Learn more about Mailchimp's privacy practices here.

    Most Read

    Most Recent

    Share your opinion