A Macedonian military man appears to be one of the driving forces behind a network of fake news websites that reached millions of people with articles often inciting hatred against muslims and migrants. Together with friends and family he has been spreading his messages via Facebook and Twitter. Sometimes under their own names, sometimes using fake identities. A look behind the scenes of the spam clans of Kumanovo.
By Peter Burger & Maarten Schenk
On December 7, 2018 U.S. soldier Jony Smith from Newark posts a link on a Facebook group named "Judge Jeanine Pirro Fans". Jeanine Pirro is a former judge now with her own show on Fox News. She is popular with Trump supporters and this Facebook fan page has over 53,000 members. Jony's link points to an article on an obscure little website named tvrtinfo.com. The news: a former British secret agent has confessed on his deathbed that he murdered Pricess Diana at the orders of Prince Philip, Queen Elizabeth's husband.
The story is fake: it was made up by the infamous American website YourNewsWire.com. The picture dates back to 2010 and shows a patient in an Australian hospital. Jony Smith is fake too. But he is an actual military man: 'Jony Smith' is one of the alter-egos of Slagan Cago Bojkovski from Kumanovo, Macedonia, who actually works for the Macedonian Army but who also moonlights as the manager of a fake news factory. Until a few days ago, his Facebook profile listed his employer and on his own profile picture which he uploaded in December he is wearing a camouflage uniform with a Macedonian flag patch.
Left: Jony Smith. Right: Slagan Cago Bojkovski.
Tvrtinfo.com, the site linked to by 'Jony Smith', is part of a network of junk and fake news websites we wrote about before. We knew they were spreading hoaxes using fake Twitter accounts and also that they were reaching a huge audience: using only two sites they reached a potential audience of 3.6 million Facebook users in only two weeks.
One article even made BuzzFeed's top-50 overview of the biggest hoaxes of 2018: 'Muslim Figure: "We Must Have Pork-Free Menus Or We Will Leave U.S." How Would You Respond This?' One hundred percent fake but enough to get over 630,000 reactions, shares and comments on Facebook.
We now know the operators of the network created over 70 websites since 2016 and that they got millions of reactions, comments and shares on Facebook with them and a slew of retweets on Twitter. The total runs to 7.16 million to be exact. To read more about the reach of the network you can read this other article:
Decline and Fall Of A Macedonian Fake News Network: Numbers Indicate Facebook's Measures Forced Desperate Move To Twitter | Lead Stories
Although Macedonian fake news merchants still generate thousands of Facebook likes and shares, the platform's recent measures against bad actors have drastically reduced their reach. The next step in the arms race takes the battle to Twitter.
In comparison: a fact checking site like Snopes gets 8.8 million in a year and needs 5,687 articles for it and a big, professional crew of editors and journalists. The Kumanovo-network consists of just a handful of part-timing amateurs and about fifteen different spammers over time who helped spread links on Facebook. Then again when you steal most of your content you don't need to bother with writers or editors much.
Who is behind this successful enterprise? It turns out they were not the proverbial teenagers who rode to world fame after the 2016 revelations that appeared about Macedonian fake news. The people behind this junk news business are adults with day jobs, often with the government, aided by family and friends.
One of Bojkovski's (Facebook) friends is Viktor Kolevski, also hailing from Kumanovo, who studied at the military academy in Skopje and who worked as a police inspector. His LinkedIn-profile says he still does but Kolevski let us know he has started working for himself at some point in time. He registered two of the domain names used by sites in the network and just like Bojkovski he pushed links to them in Facebook groups for Trump supporters. It appears they had a business relationship at some point: both registered websites that later shared the same Google Adsense ID, implying the ad revenue went into the same account.
Bojkovski and Kolevski aren't the only fake news entrepreneurs with military connections. Back in February of 2018 Lead Stories already discovered a different network of seven sites was run by officer Marjan Zlatanovski and his wife Mare Krsteva. After being outed Zlatanovski deleted his Facebook profile but a new one using Cyrillic spelling of his name appeared in the friend list of Kolevski.
That partners are involved is not a coincidence: in Macedonia the fake news trade is a family business..
Family business
Here's the business model in a nutshell: on their mostly anonymously registered websites the network's operators post clickbait articles that appeal to conservative Christians, Trump supporters, populists, conspiracy thinkers or even overt racists. They then "seed" this product on Twitter and Facebook with the help of friends and family, sometimes under their own name but also while using fake accounts. This draws a crowd to their website. Clicks turn into cash via ads shown through Google's AdSense ad network (or a similar service). That's how simple it is.
Most of the stories aren't written by the operators themselves: they are mostly copied from English-language sites ranging from conservative news outlets like Fox News to various conspiracy-ridden blogs. We suspect some stories were even stolen multiple times in a row by different websites from different networks copying from each other after they noticed a story working well for somebody else.
We could deduce this from all kinds of "mutations" showing up in different version of the same article over time (missing words or paragraphs, image captions becoming part of the article text, images getting replaced, bits of text getting duplicated...). Often these changes had little impact on how well the article did.
You don't need to be a computer genius to do all this. Most operators from the Kumanovo-network appear to be middle-aged Macedonians with no special internet marketing skills, judging by their personal profiles on social media. And even though the stories they post are politically very charged their motive doesn't seem to be politics. On Facebook they keep business (political clickbait) and private (family gatherings, selfies, internet wisdom, music videos) strictly separated. It's all about the money.
Another thing that doesn't conform to the stereotype of the savvy teenagers is the emphasis on family in this trade. The fake Twitter account of "Moly Anderson" (now deleted by Twitter) used to have pictures of Slagan Bojkovski and his wife Natasa as its avatar.
'Moly Anderson': fake account using a picture of Natasa and Slagan Bojkovski.
Natasa's face also graces other fake accounts, just like that of one of her close relatives.
Other relations of the Bojkovskis also consider spamming fake news a fun activity for the whole family. A woman from Veles (the town that rose to fame in 2016 as the capital of fake news) and her kin were happily promoting one of Slagan's sites in Facebook groups with names like 'VOTE TRUMP ONLY' and 'Swamp Drainer Disciples', each boasting between 30-40K members.
Toni and Mirjana Risteski from Kumanovo, Facebook friends with the Bojkovskis, ran their own site named unisharenews.com. Toni was the one who registered the site (which is no longer online) while Mirjana and their daughter promoted it. In 2017 Mirjana shared posts in Facebook groups like 'We Love President TRUMP' and 'THE TRUMPERS!!!' with clickbait headlines like 'Liberal Feminist Takes In Muslim Refugee For The Night, Wakes Up To Horrifying Surprise In Her Bedroom Hours Later'.
In the same circles we found a truck driver with a tattoo which eventually put us on the trail to find the key people in the network (read all about that here). He used his own name to dump truckloads of junk and fake news on Facebook and did the same while disguised as 'Jesica' on Twitter. And he wasn't the only fake Jesica we met.
68 Jessicas and other fake identities
On January 3, 2019 Jony Smith, a known sockpuppet of Slagan Bojkovski, posts a story from ludinfo24.com to the Facebook group 'Judge Jeanine Pirro Fans' (53,000 members). One minute later one 'Ema Brown' posts the same link to the group 'Deplorables for Trump' (18,000 members) and another minute later 'Lisa Sanders' puts it in 'Pauline Hanson's One Nation', a group for supporters of a right-wing populist politician from Australia (23,000 members). Ema Brown and Lisa Sanders are also Slagan Bojkovski sockpuppets.
Ema Brown studied at Skopje university according to her Facebook profile and 'works at Facebook'. Lisa Sanders is 'self-employed'. Ema's profile picture is stolen from Serbian singer Aleksandra Prijović, Lisa's belongs to Macedonian singer Viktorija Loba.
Two fake accounts that seeded Kumanovo-network posts in Facebook groups.
We counted about fifteen of these kinds of fake accounts in the friend lists of Bojkovski & co. Half of them haven't even been active yet, they are waiting in the wings until they are needed. The fact that they are interconnected with the real members of the Kumanovo clan (including young children) probably makes it harder for Facebook to detect them.
Still, recent measures by Facebook seem to be making an impact: in the past year the average reach per post of sites in the network has cratered (read our analysis of the reach numbers here). Kumanovo's fake news farmers are intensifying the planting and seeding of their crop on Twitter. And they are learning from their mistakes. Last year they tried to use small numbers of accounts to gain large follower bases so they could then spam many links to them. And it worked: the non-existent Lori Coutler sent out over 500 tweets and gained 11,000 followers in three months. But when Twitter suspended her account all that reach just evaporated.
The new strategy seems to be to create a few new accounts every day that only send out a handful of tweets and never gain more than a few hundred followers. Since last November over 450 fictitious women appeared on Twitter, including 68 Jessicas en 28 Jesicas (have a look at the list). They gained over 33,000 followers in a month-and-a-half and Twitter only removed ten of these fake accounts so far.
Slagan Cago Bojkovski's own Twitter account is still active too with a mix of authentic and fake. On Twitter he poses under his own name (@Slagan, screen name: Cago) as a Republican from Chicago with a passion for police dogs.
Slagan Bojkovski's Twitter account
The Macedonians react
We attempted to contact the members of the Kumanovo-network named in this story. We put our findings to them by email, Facebook Messenger and by phone with the aid of an interpreter. Viktor Kolevski only told us something about his job in a few words: even though his LinkedIn profile says he is a police inspector he claims he isn't anymore. Dapcevski, the trucker, was prepared to answer a question but hung up before it could be asked. The Risteskis, who ran their own little hate website unisharenews.com in 2017 did not reply to any of our questions.
Slagan Bojkovski initially denied having anything to do with fake news websites - he wouldn't even know how to make one. Later he admitted he used to have a site two years ago but that he quit, 'just like everyone in Macedonia anyway'.
Why would his own picture and that of his wife appear on fake Twitter profiles in that case? According to him someone else must have stolen his pictures. The false Facebook account of U.S. soldier Jony Smith he was Facebook friends with? He didn't know who we were talking about. And he himself didn't work for the army since one year anyway.
Before we called Bojkovski fifty of the seventy-five websites of the network were still active. A few hours after the call about forty of those went down, one after the other. (The remaining ones mostly had been inactive for several months already.) This massive vanishing act made over 3,500 sensational (SHOCKING! BREAKING!), scary (CIVIL WAR! PEDOPHILES!), inciting (RAPE! BURN! KILL!) and hateful (MUSLIMS! REFUGEES! MIGRANTS!) articles disappear from the internet.
Also fallen on the field of (dis)honor: the Facebook account of 'Jony Smith'.
The Kumanovo-connection Files
This investigation has been a coproduction of Nieuwscheckers and Lead Stories. A selection of these stories appeared on both sites - in Dutch and in English.
Nieuwscheckers published:
- De Kumanovo-connectie: Macedonische familiebedrijfjes verdienen geld aan nepnieuws over moslims en migranten
- Door maatregelen van Facebook zaaien nepnieuwsboeren vaker op Twitter
- Hoe een tattoo ons naar de Macedonische vrachtwagenchauffeur leidde die ladingen nepnieuws afleverde op internet
- Met deze tools en methoden brachten we een Macedonisch nepnieuwsnetwerk in kaart
- Macedonische makers van nepnieuws nog actief
- Twitter-trollen promoten vanaf Balkan netwerk van anti-islamsites
Following articles appeared on Lead Stories:
- Macedonian Fake News Network Shuts Down Dozens Of Websites After Joint Investigation By Lead Stories & Nieuwscheckers
- How A Tattoo Led Us To The Macedonian Trucker Delivering Loads of Fake News To The Internet
- The Kumanovo-connection: Macedonian Spam Clans Still Make Money With Fake News About Muslims and Migrants
- Here Are The Tools And Methods We Used To Map A Macedonian Fake News Network And The People Behind It
- Decline and Fall Of A Macedonian Fake News Network: Numbers Indicate Facebook's Measures Forced Desperate Move To Twitter
- Meet The Macedonian Officer Running A Ring Of Fake News Websites
- Update: Macedonian Officer Launches New Fake News Website
- Old Network of Anti-Islam Fake News Websites Turns To Twitter Trolling
- Fake News: Angela Merkel Did NOT Say Nation States Must Give Up Sovereignty To New World Order
- Fake News: NO Media Silence About Woman Stabbed 14 Times in Minnesota
- Fake News: Muslim Somali Sex Gang Did NOT Say Raping White British Children Was Part of Their Culture
- Fake News: Saudi Arabia Is NOT About To Behead 6 School Girls For Acting Indecently With Their Male Friends
- Fake News: Clinton Foundation NOT Ordered To Cease Operations - Chelsea NOT Charged With Fraud
- Fake News: German Biker Gangs NOT Beating the Hell Out of Muslim Refugees
- Fake News: Gene Hackman Did NOT Say 'Donald Trump Could Easily Turn Out To Be One of The Best Presidents That America Has Ever Seen'
- Fake News: Civil War Did NOT Erupt In Sweden; Irate Swedes Did NOT Burn Nine Muslim Refugee Centers to the Ground (Again...)
- Fake News: Flight Crew Did NOT Take A Knee And Did NOT Walk Off, NOT Leaving New Orleans Saints Stranded On Runway
- Fake News: Woman Did NOT Set Pedophile Muslim Man on Fire After Catching Him Rape 7-Yr-Old Daughter
- Old News: Largest Food Stamp Fraud Bust In History, $20M, Muslim Store Owners Arrested in Florida
- Fake News: Pedophile's Decapitated Corpse NOT Found On Judge's Doorstep After Bail Hearing
Image credit: Google Streetview
