A Look Into Viral North Macedonian Content Farms
Contributors: Jack Cable, Isabella Garcia-Camargo, Renée Diresta, Stanford Internet Observatory
Graphika Team
Clickbait operators in the town of Veles in North Macedonia are running a number of websites that target conservative Americans with partisan content copied from American outlets. The websites are gaining significant traffic, especially from what appears to be the operators’ account on Parler, which is a major influencer with hundreds of thousands of followers.
Veles emerged as a hotbed of partisan clickbait in the 2016 U.S. electoral cycle. The latest websites follow the tradition of copying content from better-known sites to generate ad revenue, but have shifted tactics to improve their chances of hiding and attracting an audience.
The operators behind these websites went to some lengths to hide, including by setting up mailing addresses in the United States through international forwarding companies. They focused their social media attention on Parler, rather than the traditional platforms. However, the main concept of their operation matched earlier iterations, using social media to drive users towards websites that were set up to generate ad revenue.
Resist the Mainstream
Upon first glance, Resist the Mainstream appears to be a standard right-wing American news site. Its about page describes itself as “report[ing] the news the mainstream media won’t”, and lists an address in Austin, TX as its mailing address.
What is not immediately evident is that Resist the Mainstream is not American at all, but rather a content farm run by two individuals from North Macedonia. Consistent with previous reporting of activity targeting the 2016 election, these individuals — from Veles, a small North Macedonian town — repost content from other right-wing news sites to generate viral stories and profit from ad revenue. The website uses tags from the InfoLink ad service and Google Analytics to track its performance and monetize its clicks.
The Veles content farms have refined their tactics since 2016 to conceal their trails and exploit right-wing social media platforms that are less likely to take down such content. The address of the site listed in Austin is a virtual mail forwarding service offered by ParcelPlus, which offers international mail forwarding. Thus, the operators in North Macedonia can receive mail in the United States without leaving their homes — very useful, in building the website’s credibility, and for verifying their identity on social media platforms.
Figure 1: Resist the Mainstream About Page listing a mailing address in Austin, Texas.
Perhaps responding to crackdowns by Facebook and Twitter on these kinds of websites, the operators focused their own amplification primarily on Parler, a right-wing social network that has recently skyrocketed in popularity. The operators of the site appear to operate a prolific Parler account, “DonaldTrumpTweets.” This account only posts content from two sources: Donald Trump’s tweets and articles from Resist the Mainstream. Its bio closely matches the website: “reporting the news the mainstream media won’t.” The account has amassed over 400,000 followers — or approximately one in every seven Parler users — and each of its thousands of posts typically receives hundreds of interactions and over 50,000 impressions.
Figure 2: Parler Profile for “Donald Trump Tweets”, an account that prolifically shares Resist the Mainstream content.
By drawing in users with content they are interested in, in this case Trump tweets, the website owners succeed in driving traffic to their site. Resist the Mainstream is ranked as the 62,111th most popular website in the United States, with 22% of its traffic coming from Parler.
The account is verified on Parler, which supposedly requires a U.S. driver’s license. Its success is evident, with the account being the first search result for Donald Trump on Parler:
Figure 3: Search results for Donald Trump on Parler yield Donald Trump Tweets first.
Uncovering the operators
The operators of the site went to some lengths to conceal their origins. They registered the domain using WhoisGuard, a service to mask the identity of a domain owner, registered a Gmail address for the site’s contact, and signed up for the digital mail forwarding service to obtain an American address.
That said, they did not cover all of their tracks. The three authors on the site, “admin”, “aleksandra”, and “viktor”, are associated with three email addresses: the admin’s gmail address (as listed on the site’s about page), and personal email addresses of both Aleksandra and Viktor.
Given these emails, we were quickly able to discover Facebook accounts for the two individuals, who are friends with each other. Both list their hometown as Veles, the infamous town home to content farms in North Macedonia.
Next, we sought to understand if there were other websites operated by the same individuals. Three other sites were hosted at the LiquidWeb IP address used by resistthemainstream.com: teamcandanceowens.com, teamcandanceowens.org, and thepetitioner.org (which at the time of writing has no content). The website carried a tag from the InfoLinks advertising platform, INFO-3278878, that also connected it with teamcandaceowens.com. Team Candace Owens appears to be a site in support of conservative author Candace Owens. Despite a disclaimer on the site’s about page that they “are not affiliated with Candace Owens”, this may not be obvious to the average visitor, as the site appears to represent Owens (and even includes a Donate button linking to Candace’s official donation page).
The about page for this site is strikingly similar to Resist the Mainstream. The stated mission is “to spread the message of Candace Owens and report the news that the mainstream media won’t report”, and the site lists a mailing address in New York. Again, this address is a virtual mailbox, this time operated by PostScan Mail.
Figure 4: Like Resist the Mainstream, Team Candace Owens lists an international forwarding mailbox, this time in New York, as their mailing address.
These individuals have operated and registered a number of other websites that are now defunct, including teamdancrenshaw.com, libertysignal.com and conservativeforever.com. The last named site was active until March 2018; its Twitter account is still visible but only posted once in 2018 and three times in April 2020.
Archives of conservativeforever.com list five Wordpress administrators: Aleksandra and Viktor, with the same email addresses as from Resist the Mainstream, as well as three new individuals: Donce, Miki, and Rumen. Donce’s Facebook account shares 8 mutual friends with Viktor. Miki, according to his Linkedin, runs a digital media agency.
Lastly, Rumen appears to run thepetitioner.org, a mostly inactive site that copies petitions from change.org (similar in activity to petitions.resistthemainstream.com, a site run by Resist the Mainstream). The site shares an IP address and hosting provider with Resist the Mainstream. Rumen lists himself as a member of Arete Syndicate, a known multi-level marketing scheme. In 2018, Rumen posted a job listing on a North Macedonian job board, in which he sought to hire people “to paraphrase texts from English to English” and offered a fixed salary of 30,000 Denar, or 570 USD at the time of posting. The posting includes the Fox News logo, suggesting that Rumen may have operated a similar content farm purporting to be Fox News.
The two live sites are home to many viral articles, such as an article on Resist the Mainstream reporting a lawsuit by Candace Owens against Facebook that received over 40,000 interactions on Facebook, according to CrowdTangle. The article was originally published on Breitbart.
Figure 5: One viral article on Team Candace Owens received over 40,000 interactions on Facebook.
In total, according to BuzzSumo, Resist the Mainstream has received over 120,000 engagements across Facebook and Twitter. Team Candace Owens has received over 225,000, putting it in the top 30,000 most visited U.S. sites.
Other viral content on these sites more directly targeted the 2020 election, such as a headline referring to the conspiracy that Joe Biden wore a secret listening device (receiving over 5,000 engagements on Facebook and Twitter across Resist the Mainstream and Team Candace Owens) and claims of mail-in ballot fraud (receiving nearly 2,000 engagements).
These sites were shared by U.S. political figures, including Pennsylvania State Representative David Rowe in a post (since removed by Facebook) that received hundreds of interactions and shares.
Figure 6: A post shared by Pennsylvania State Representative David Rowe linked to a Resist the Mainstream article.
Taking a page from Teodor Mircevski?
We observe some resemblance between these websites and those operated by Teodor Mircevski, a notorious fake news operator from Veles. Mircevski’s websites — examples being conservativefighters.org, conservativefighters.com, donaldtrumpnews.net, and conservativemedia.com — have received millions of interactions on Facebook and Twitter.
One single article by Conservative Fighters, titled “Virginia Republican Running To Become First Female Marine Elected To Congress”, received over 120,000 interactions on Facebook alone. The original article, published on the Daily Wire, obtained over 220,000 interactions, meaning that Mircevski’s site succeeded in driving a large amount of traffic to its own site.
The Twitter account of Conservative Forever twice posted links to conservativefighters.org, a website operated by Mircevski. The infrastructure between Mircevski’s sites and the previously mentioned sites also bears a resemblance. All domains are registered on Namecheap, and use the web hosting platform LiquidWeb. There is insufficient evidence to determine whether these resemblances are the result of the Resist the Mainstream operators copying Mircevski, or a more systematic relationship.
Conclusion
These North Macedonian content farms, in response to increased enforcement by the largest social media platforms, have adapted their techniques to be more opaque and operate on sites that are less likely to perform takedowns. We suspect that disinformation will continue to spread on sites like Parler, as evidenced by a recent Graphika report documenting suspected Russian Internet Research Agency activity promoting a news site on Parler and Gab.
We have no reason to suspect that the operators of these sites are motivated by anything other than financial gain. However, they continue to profit from, and possibly contribute to, polarization in America, with right-leaning individuals unwittingly consuming foreign-amplified content. These tactics, such as reposting content from other right-wing news sites, as well as tweets from Donald Trump, appear to be effective in building an audience and driving traffic. We have already seen more sophisticated and politically motivated foreign threat actors copying domestically produced partisan content on both the right and the left to create their personas and build an audience, notably the suspected IRA operations NAEBC (conservative) and PeaceData (progressive). However, interestingly, their efforts were less shared and viewed than the clickbait sites studied here.
We shared these sites with social media platforms in advance of publication. Facebook blocked all referenced websites from being shared and removed past posts sharing links to these sites. Pinterest blocked all referenced websites.