The phenomenon of “fake news” factories took off and became internationally known in 2016, when a small town in North Macedonia turned into one of the epicentres of digital disinformation production during the U.S. presidential elections.
At the time, local young people discovered that they could generate fat profits through Google AdSense by creating websites with fabricated, sensational news — mostly pro-Donald Trump — which went viral on Facebook. The stories had no political agenda; their only aim was financial.
The 2016 episode appears to have left behind a ‘business model’ in North Macedonia which, although it has changed shape, continues to be sustained on fake news or clickbait headlines. BIRN identified more than 25 Facebook pages, with offshoots on YouTube and TikTok, which use “affiliate marketing scams” (defrauding consumers via affiliate networks) to sell “medicines” or harvest clicks, all controlled from North Macedonia. The bulk of the pages target Albanian-speaking readers, although some publish in English.
“Affiliate marketing scams” is a form of cybercrime in which fraudsters abuse the legitimate marketing model to make money dishonestly. A detailed analysis of Facebook transparency data and of the source code of the websites reveals a sophisticated network.
For cybersecurity and media experts, these structures are highly dangerous; they simultaneously breach the privacy of victims, their wallets, and the public’s trust in serious media.
Bardhyl Jashari, executive director of the Metamorphosis Foundation in North Macedonia — a media organisation that promotes human rights online — told BIRN that the concrete consequences of these platforms include the degradation of “the standard of information and the role of the media in a democratic society”.
“When people realise they have been deceived by a ‘patriotic’ page, they become cynical even toward serious media,” Jashari said.
Security expert Besmir Semanaj says the amount of information these pages collect is alarming.
“These intermediary servers analyse in real time the device, location, source of the click and behaviour of the visitor in order to determine whether this is a real user or a control system of the platforms,” he notes.
The fraud network
The data BIRN obtained on around 25 Facebook pages show that this disinformation ecosystem is not sporadic. It is run by a structured group of administrators based in North Macedonia and, in some cases, with partners in Italy, Germany, Vietnam or the U.S.
Two of the pages, “Media Shqiptare” and “Live News”, display a hybrid cooperation model with two administrators in Macedonia and one in Italy.
This structure suggests that EU-based locations are being used to lend credibility to the page in the eyes of Facebook’s algorithms and of advertising networks, while the actual operation is carried out from the Balkans. Meanwhile, three pages — clones of one another, all called “Usa Story” — are managed by people in North Macedonia, Kosovo and the U.S. These pages mainly publish in English on Facebook, but if you follow the links and dig into the website, you also find posts in Albanian on the same model.
Irrespective of the name and the main language, these pages publish material and direct readers to a group of 5–6 links that funnel them onto pages where the medicine ads sit. Based on the links offered to readers to click, the identified pages are split into 3 groups that appear to operate separately.
The first group, which on YouTube publishes under the name “Jetë & Stil”, uses pages such as “Mergimi Shqiptar” and “Gazeta Insajd” to push the audience toward the portal lifestories99.com and a Germany-based YouTube channel, run by 6–7 administrators.
The largest group, “TimeforLon”, mobilises numerous pages such as Lajm24, Mesazhi and Gazeta Zëri to spread links to miimall.com and bilgiliyor.com, as well as to the YouTube channel “Timeforlon” in the U.S., engaging teams of 4–8 people for each page, all in North Macedonia.
Finally, the “Viral Stories” group operates through “Media Shqiptare” to feed viralsstories.com. The pages of this group are also run from North Macedonia.
Analysis of the code of the websites to which the social-media posts redirect users shows that the final goal is the links on which miracle medicines are sold at promotional prices. The pages where traffic is directed are filled with fake doctors’ testimonials.
Their concentration in North Macedonia is, according to Jashari, a consequence of accumulated experience and of the complexity of the cases, where, despite penal legislation against cybercrime, criminal prosecution is difficult.
“In other words, the legal vacuum here is often not a total absence of laws, but an uncovered area, where the audience and the harm are abroad,” he said.
According to him, this situation leaves it unclear who is responsible, creating a “paradise” for this activity.
“So the ‘paradise’ is not because everything here is free and without rules. The ‘paradise’ lies in the fact that this combination — low cost, accumulated experience, international networks, and the difficulty of enforcing laws — makes the risk relatively low and the profit relatively high,” he said.
Technical sophistication
The pages in question use almost the same images and the same methods. The source code of the pages reveals the presence of aggressive ad trackers, such as adstrktrk3.top, which are used to redirect users or register fake clicks.
The websites primarily use the WordPress platform, camouflaged with a generic blog design, and most have only been live for a few months. This group is identified as the “Aurora Portal” and mainly uses Facebook pages that appear to deal with information, including by copying well-known headlines such as those from Koha Ditore.
Security expert Besmir Semanaj told BIRN that, although the pages appear simple, they have a high level of sophistication aimed on one side at deceiving platforms such as Facebook to avoid being blocked, and on the other at deceiving the individuals who fall prey to the ads. “Dangerous code is often integrated through modified plugins, obfuscated JavaScript scripts or server-side redirect rules, which are activated only for certain segments of visitors,” Semanaj says.
According to him, the sophistication does not lie in the design or the visual content, “but in the ability to control and manipulate traffic, to switch domains quickly and to hide the page’s real behaviour from monitoring platforms”.
Semanaj says that distributing administrators across several countries and including admins from EU countries on the page serves as a technical and operational masking mechanism.
“By using IPs, accounts and access from various countries, the network creates the impression of a legitimate international structure,” he said.
Internationalisation is also, according to Jashari, one of the elements that allows the beneficiaries behind these pages to hide.
“This creates a fog: when something goes wrong, it is difficult to say quickly who is responsible — the company in the U.S., the operators in North Macedonia, the partners or the intermediary services,” he said.
Bought or stolen pages
The network identified does not invest in media production or in growing followers through the material it publishes; it has invested in buying ready-made audiences or in changing the destination of pages created earlier, primarily for religious purposes or for sharing memes.
The page known today as “Gazeta Zëri”, with 45,000 followers, started life in 2016 as “Musliman Elhamdulilah”. After it gathered thousands of believers, it was transformed into “Ramazani Muaji i Bekuar”, later into “Video Interesante”, to end up today as a news portal feeding ad pages. The same story lies behind the page named “Mesazhi”.
The people behind these pages have no religious bias. One of the pages is “I Belong to Jesus”; it publishes mainly in English with fictitious “dramas”, accompanied by AI-generated videos and, ironically, fake news about the 2016 U.S. elections. In other cases the pages have been bought or hijacked from users in Asia. The page “Live News” was originally created in Bangladesh as a school page before being turned into a propaganda tool for the Albanian audience.
The page “Lajm24”, with 77,000 followers, began its journey under the name of the narcotics trafficker “Pablo Escobar” before turning into a source of “information”. The pages have changed several URL addresses where the ads are placed.
For Semanaj, this practice is also part of the technical masking.
“The pages and accounts known as ‘zombies’ usually have a previous legitimate history, such as abandoned portals or pages originally created for entirely different purposes, often in Asia,” he said.
For his part, researcher Erlis Çela points out that the use of pages that previously had legitimate content makes the fraud much harder to identify for the reader.
“Following (a page) is often linked to habits and to the behaviour we as an audience develop in relation to media and information consumption, rather than to verification as a preventive behaviour against disinformation,” Çela said.
According to him, people follow a page and trust it because they have followed it for a long time, but when it changes its name and habits, this is hard for some of the audience to spot.
“When a news page changes name and mission, part of the audience is not able to spot the difference,” Çela said, adding that the trust is mistakenly transferred to the information channel — Facebook, Instagram or other channels.
Jashari also stresses this.
“This tactic is among the most dangerous, because it turns trust — especially religious or patriotic trust — into fertile ground and infrastructure for manipulation. The moment an inherited page with a ‘ready-made’ audience changes its ownership or orientation, the public does not realise it is consuming an entirely different product,” he said.
Meanwhile, beyond Facebook and the web, the scheme has spread to YouTube and TikTok in order to maximise profits. For example, the page “Media Shqiptare” promotes the channel @LEIDSSTORY, which has more than 21,000 subscribers and around 10 million views, with its declared location in North Macedonia.
