Just Because It's Trending Doesn't Mean It's True
Hoax Alert

How A Tattoo Led Us To The Macedonian Trucker Delivering Loads of Fake News To The Internet

  • by: Maarten Schenk
  • (Fri, 18 Jan 2019 02:00:44 Z)

If this was a detective novel it would have been the point where the hero and his trusty sidekick know there must be a single shadowy underground organization behind the recent string of heists in the city but they still have no clue who the villains are. They would be sitting at the police station going over the available evidence and crime scene photos again and again, lamenting about the lack of clear fingerprints and muttering things like "These guys are good" or "Definitely a professional".

"Another new site? Anonymously registered? Damn, these guys are good!"

And then suddenly some mystery woman would turn up with the one vital clue that had escaped their attention and the whole case would crack open like a nut...

"Hi. I'm Jesica. My name does not end in a number."

In our case the first message that would lead to the vital clue arrived in the form of an automated email notification from the Trendolizer software we were using to track the network. A new site named coolinfo24.com had just gone live and Trendolizer noticed it was using the same Adsense advertising account code as several other sites in the network.

Just like we would expect several Twitter accounts masquerading as young, attractive women were already hard at work spreading links to it:

'Hi. Our names are Jesica too!'

And then it struck us: one of these was not like the others. The sixth account also had a female avatar but a weird name: @dapcevski - it didn't end in a number. And "she" was much older than the rest:

The photo is actually Serbian singer Sandra Afrika's current Facebook and Twitter profile picture.

But wait! The Google cache revealed "Jesica" was not always a woman. She used to go by "dapcevski" in 2016 and her profile avatar used to be some kind of shield with the letter "M" in it.

A Google images search for "dapcevski" revealed what was probably the missing image in the January 14 post and also revealed a link to the page of a pyrography (wood burning) artist from Kumanovo, Macedonia on Facebook.

Another Google search revealed someone named "Saso Dapcevski" had left a comment on that page at some time:

Someone going by that name used to have a Google+ profile using the exact same avatar:

And clicking that avatar revealed that the M-in-a-shield was a big tattoo on someone's shoulder:

And look: there's a Saso Dapcevski on Facebook who happens to have that exact same tattoo!

His wife posted this holiday snap in 2015, exactly the same image that appeared as the first result in the Google Images search results for "dapcevski", revealing it was also present at one time on the @dapcevski Twitter account (where it now seems to have been removed) thus proving the connection:

Not only that: the Facebook account was already used all the way back in 2017 to spam links to libertymagazine.net, another site from the network:

Mr. Dapcevski seems to be part of several groups for truckers and drivers on Facebook:

He was also seen posing next to several trucks at what seems to be a picnic at what looks like some kind of truck stop in Germany:

An expert in Slavic languages we contacted also pointed out that "tamche", as in the domain name "tamche1966.com" used by one of the sites in the network, apparently can mean "van" or "small truck" in Macedonian/Serbian when it is spelled as "tamče" (TAM is a local company that used to make trucks and busses, "tamče" is a term of endearment like "little"; as if a Swedish trucker called his rig "my little Volvo"). And Mr. Dapcevski does look like he could be born in 1966.

Tamche1966.com & the TAM logo

So we finally had a lead! With renewed enthusiasm we started looking into who else was spreading links to sites in the network using a variety of other tools and techniques and we found out Dapcevski was just one node in a much larger network.

In the end we uncovered several groups of related people from the town of Kumanovo in Macedonia who were all involved in some way, along with several fake Facebook profiles and a big list of Facebook pages and Groups that were used to seed links to articles from their websites. Using Facebook Messenger, we sent Mr. Dapcevski a message and with the aid of an interpreter, we called him for comments. At first, he said he wanted to answer some questions, but before we could ask them, he hung up on us.

It would have been the perfect crime if it hadn't been for Jesica and her tattoo... and the mile-wide trail of other clues we eventually discovered. You can read all about that here.

Image credits:


About the author:

Maarten Schenk is our resident expert on fake news and hoax websites. He likes to go beyond just debunking trending fake news stories and is endlessly fascinated by the dazzling variety of psychological and technical tricks used by the people and networks who intentionally spread made-up things on the internet.  He can often be found at conferences and events about fake news, disinformation and fact checking when he is not in his office in Belgium monitoring and tracking the latest fake article to go viral.

Read more about or contact Maarten Schenk

About Lead Stories

Lead Stories uses the Trendolizer™ engine to detect the most trending stories from known fake news, satire and prank websites and tries to debunk them as fast as possible. Read more about how we work and how we select stories to check here.

Spotted a hoax that you think we should investigate? Have a tip? Want to send us a correction? Contact us!

You can also follow us here:

Most read

Recent

Like or Follow us to get the latest!

NEW! Subscribe to our YouTube channel: