Tag Archives: visualization

Uncovering the Rose Hosting Spam Network on Quora

Welcome back to Dirty, Slimy, Shady Secrets of the Web Hosting Review (Under) World - Episode 3! Read Episode 1 | Episode 2

Today's post features Rose Hosting. Who I refuse to link to because their whole business model seems to involve comment spamming this blog and other sources of information. What started with a simple spam comment sent me down a rabbit hole I wasn't prepared for and shed light on a fairly large spam operation that spanned multiple sites, but my primary focus became Quora with a secondary focus on the web hosting review sites also being manipulated.

Visualization of Rose Hosting Quora Spam Network. An interactive version is available at the end of the article.

The Beginning

It started with a simple spam comment.

fakereview1

The poster tries to compliment the post and then drops in a RoseHosting mention and praises it.

But wait, there's an IP address! Looks like they made a mistake this time.

oscarstanley-arin-ip

So Miami Cloud Hosting is who owns the IP space that this comment came from. Let's see what comes up when I ping rosehosting.com

rosehosting-ip-ping

If you go to that IP, rosehosting.com shows up. So it's correct. Also if you look at their DNS:

rosehosting-dns

So we're 12 IPs away on that A record. Let's check out that IP that actually responded on ARIN.

rosehosting-arin-ip

Bingo. Same Miami Cloud Hosting.

So fakeish looking name, an email with zero google search results and coming from the same IP space on a the cloud hosting provider that hosts RoseHosting. Pretty damning, but unsurprising to see some astroturfing, many of the bigger players just rely on affiliates to do it for them and look the other way.

But I'm not one to accept shitty behavior in this business and just look the other way.

Digging Deeper

Let's see how many more I can dig up. I recognize the Rose Hosting name and know they've spammed me in the past.

jean-debushy-comment mike-hidemyass-comment pablo-comment

mateo-comment

 

The pattern seems to be emails with nothing associated with them on google. There is a protected twitter account with the same username as Pablo, but that's about it.

Mike uses HideMyAss, a VPN service designed to hide identities. VPNs/anonymity have a lot of value, they also happen to be abused by spammers a lot. This pattern looks nefarious.

Jean's comment follows the original Oscar comment's template: compliment, rose host spam, compliment.

They all added in HTML with the rel="nofollow" because they probably realized Google can easily see comment spam and cracked down on it. Putting a nofollow link is supposed to preserve your SEO value by not associating it as a spam link (because it's telling Google not to follow it). Why are these supposed customers adding SEO tactics to their comments and trying to hide their identities?

The Boss Man

I also got this email from Bob, who I assume is the owner based on what's listed publicly and the interviews he's done on at least one other review site which I don't trust a bit, and won't link to either.

But it's all class, I want to get listed and pay a lot.

generous-affiliate-program-rosehosting

So at best they are a 'subtle' please promote me for money kind of web hosting company (which almost every host will do). At worst, they are comment spamming and potentially astroturfing/sockpuppeting web host.

Searching For More

I searched WebHostingTalk, the largest web hosting forum that has run forever and has over 9 million posts.

rosehosting-wht

Just about everyone is talked about here. They have a company account that constantly posts ads. But how is it that in 14 years there are only 2 reviews and most of the threads are asking 'who?' Yet somehow, my blog is getting hordes of accounts recommending them. Another red flag.

Did they learn their lesson on WHT when an account got questioned about sounding like a shill? So the largest forum with 9,000,000 posts has basically nothing about them.

I kept searching and stumbled upon this gem on Twitter

twitter-brandonhimpfen-rosehosting-comment-spam

twitter-brandonhimpfen-rosehosting-discussion

I sense a pattern. Those crazy customers of ours who link to git and tomcat installation tutorials. Carl had a bit of a spamming spree according to Google.

Let's keep digging.

Sockpuppets and Patterns

jeandebushy-reddit-comments

Looks like I found Jean Debushy!

jean-debushy-serchen-review

And again.

jean-debushy-itzgeek-comment-spam

And again. Deep linking their ubuntu VPS on an ubuntu tutorial too, nice SEO tactic.

jean-debushy-quora

It's not a good spam campaign without hitting Quora!

So this name exists solely to promote RoseHosting and it all seemed to happen in October 2015. That's suspicious to say the least.

At this point it became clear that the sockpuppeting is more organized than I originally thought.

Organized Sockpuppets

I started to search the other names I had been spammed from and easily found more bad behavior.

oscar-stanley-disqus

oscar-stanley-discovercloud

Oscar is alive and well it seems on Disqus. and DiscoverCloud.

The Smoking Gun

Quora was the gold mine for uncovering this spam network. Once I found a couple accounts on Quora, I could go through their history and see who upvoted their posts. It would be practical if you were running a spam network to have many accounts upvoting one another to give yourself more visibility. More upvotes, more traffic, easier for me to track it all down.

I discovered 51 accounts connected to RoseHosting and mapped out how they connected to one another. I took those same names and searched for their re-use across other sites. 10 showed up on Serchen, 3 on HostReview, 6 on DiscoverCloud, 6 on HostAdvice, 3 on TrustPilot, 1 on Reviews.co.uk - all industry review sites being manipulated by these same spam accounts. I also discovered 11 more accounts connected to various review sites and comment spam.

Rose Hosting Quora Spam Network

This graph charts the connections (upvotes) of RoseHosting associated Quora accounts. If you hover over a name it links to the Quora details and any other related content spamming like review sites.

Aftermath

I tried for months to reach out to Quora and have never heard a word from them. I did notice when I last checked (March 28, 2017) that at least some of the accounts have been banned. Maybe someone actually read my email and just didn't have the time to respond.

I have reached out to the web hosting review sites and will update as I hear back from them. The only company that did respond and acknowledged the issue was HostAdvice (not to be confused with HostingAdvice which steals Review Signal content to mislead its visitors).

Sources

Full Data Table Available on Google Docs

 

Bonus

Thanks RoseHosting for having the decency to make sure you spammed this article as well. I am guessing your spammers don't understand irony. Or possibly the English language.

A new comment on the post "Uncovering the Rose Hosting Spam Network on Quora" is waiting for your approval
http://reviewsignal.com/blog/2017/03/31/uncovering-the-rose-hosting-spam-network-on-quora/

Author: Merritt George (IP: 75.86.176.9, cpe-75-86-176-9.wi.res.rr.com)
Email: merritt.george@gmail.com
URL:
Comment:
That's a great article! There sure are interesting parts of web hosting that people don't know about.

So hey I wanted to know if you do reviews on new sites? I was looking around and noticed that my current webhost, <a href="https://www.rosehosting.com/" rel="nofollow">Rose Hosting</a> wasn't listed and that's a shame! In a sea of companies with no scruples, they've stood out to me as a solid company that doesn't resort to shady tactics, delivers quality support, and has great uptime.

Would love to see a benchmark!

 

Bonus: Fake Review Screenshots

carl-williams-serchen-review

 

donald-wilson-discovercloud

 

akila-hostadvice

wesley-hermans-host-advice

emre-hakan-review-discovercloud

pete-williams-serchen

gary-coleman-hostreview

jean-debushy-hostreview

 

dirk-vlaar-serchen

 

The Rise and Fall of A Small Orange

If you're an unhappy A Small Orange customer looking to find a better web host and don't want to read why the quality went down, simply head over to our Web Hosting Reviews and find a better hosting company. 

How did a small web hosting company have such a huge impact on Review Signal?

The Early Days

This story begins in October 2011, a year before Review Signal launched. Review Signal had been collecting data for months and early ratings data was starting to become meaningful. A tiny company was at the top of the rankings. A Small Orange.

The most worrisome part of this revelation was that A Small Orange did not have an affiliate program. Which isn't a requirement at all for a listing on Review Signal.

However, after investing years of work, if the top rated company ended up not having an affiliate program, the business was likely sunk before it even started. So I inquired early and heard back from the CEO at the time, “we don't have an affiliate program and at the moment, we have no plans for one.” This was a potential death knell because the entire business model relies on making at least some money, even though I assumed it would be much lower than my competitors who simply sell their rankings to the highest bidder. But as any entrepreneur knows, almost everything is negotiable if you understand what the other person really wants and why. After talking further with the CEO, he explained his issue with web hosting review websites, “they typically have a pay for ranking sort of model and do it either through set rates or affiliate payouts. It varies. The economics at ASO don't really work out for a standard affiliate program.” A Small Orange didn't want to play the game that every other review site out there did. Pay to play, quality be damned.

This CEO hated the games being played as much as I did.

That was all the opportunity I needed. Review Signal's mission has been to fight against that very same model and I knew I had an early ally who could make this work. We ended up working out a deal to pay three months of whatever plan someone purchased and he put a cap on my potential earnings at $250 before he would review the performance. Considering the most popular plans were $25/year and $5/month, this wasn't going to earn a lot, but at least it might start covering some of the very basic costs. The first month I earned $52.38 on 6 sales for an average of $8.73 per sale with A Small Orange.
At least it was something. And a foot in the door was all I needed to prove this crazy idea called Review Signal might have some legs. A Small Orange opened that door and for that our histories will forever be intertwined.

The Good Times

The next few years were very good. I was their first affiliate. I was their biggest affiliate for many years, bringing in over a thousand new customers. I got to know many of the staff and would consider some of them friends. And A Small Orange continued to be the best rated shared hosting company through 2014. Everyone was happy - their customers, the company and Review Signal. I was happy to recommend them based on the data showing they had incredibly satisfied customers. I had people tell me personally they were very happy with them after signing up because of the data I publish here at Review Signal.

2014-01-20 13.34.07

Free Swag and Annual Thank You Card from ASO

The EIG Acquisition

A Small Orange was quietly acquired in 2012. They were acquired by a behemoth in the hosting industry called Endurance International Group (NASDAQ: EIGI) which owns dozens of brands including some of the largest and most well known hosting companies: Blue Host, Host Gator, Host Monster, Just Host, Site5, iPage, Arvixe and more.

EIG has a very bad reputation in the web hosting world. If you ask most industry veterans they will tell you to run to the hills when it comes to EIG. The oft-repeated story is EIG acquires a hosting company, migrates them to their platform and the quality of service falls off a cliff. The best example of this is perhaps their migration to their Provo, UT data-center which had a catastrophic outage in 2013. This outage was huge. The impact dropped four of EIG's largest brands many percentage points in the Review Signal rankings in a single day.  But these major outages continue to happen as recently as November 2015.

In a recent earnings call with share holders, EIG CEO Hari Ravichandran talked about two recent acquisitions and their plans for them. “We expect to manage these businesses at breakeven to marginally profitable for the rest of the year as we migrate their subscriber bases onto our back-end platform. Once on platform, we expect to reach favorable economics and adjusted EBITDA contribution consistent with our previous framework for realizing synergies from acquisitions.”

The EIG Playbook

EIG's playbook has been to acquire web hosting brands, migrate them to their platform and 'reach favorable economics.' They've been doing it for years and it seems to be working well enough for investors to continue to put money into the company. M&A to grow subscriber bases and economies of scale to lower costs. It's a very simple and straightforward business plan. It doesn't speak to anything beyond spreadsheet math though, such as brand value and customer loyalty. And those are certainly lowered and lost post-EIG acquisition according to all the data we've collected over years and multiple acquired brands. It's calloused business accounting, but it makes perfect sense in the race to the bottom industry that is commodity shared hosting.

Review Signal Rating Calculated Pos/(Pos+Neg), without duplicate filtering

Review Signal Rating Calculated Pos/(Pos+Neg), without duplicate filtering

You can see all the EIG brands tracked here on Review Signal in the chart above and their acquisition dates below:

iPage - 2009. BlueHost/HostMonster - 2010. JustHost - Feb 2011. NetFirms - March 2011. HostGator - June 2012. A Small Orange  - July 2012. Arvixe - November 2014. Site5 - August 2015.

You'll notice their ratings, in general, are not very good with Site5 (their most recent acquisition) being the exception. iPage was acquired before I started tracking data. BlueHost/HostMonster also had a decline, although the data doesn't start pre-acquisition. JustHost collapses post acquisition. NetFirms has remained consistently mediocre. HostGator collapses with a major outage a year after acquisition. Arvixe collapses a year after being acquired. Site5 is still very recent and hasn't shown any signs of decline yet.

The Expected Decline of A Small Orange

So nearly every industry veteran I talked to expected A Small Orange to collapse. Immediately after acquisition. Except me. I was, am and will continue to be willing to give the benefit of the doubt to a company until I am shown evidence.

For years, post acquisition people were saying ASO's demise was right around the corner. For years, I still waited for that evidence and the prophecy to become true. But it didn't happen.

It often took EIG less than a year to ruin a brand. We don't have to look further than Arvixe for an example of this, which was acquired in November 2014. Today, Arvixe has one of the lowest ratings of any company on Review Signal at a shockingly low 27%.

But A Small Orange continued to chug along. It didn't hear the naysayers or believe itself to be a victim of the EIG curse. Instead, ASO was the best shared host for years post-acquisition. It seemed to have a fair level of autonomy from the EIG conglomerate. The staff I knew there, remained there, and all indications showed they were still the same company.

Until it wasn't.

The Fall of A Small Orange

A Small Orange Historical Rating

A Small Orange Historical Rating

The chart above shows Review Signal's rating of A Small Orange. The Blue line is the rating as calculated by [Positive Reviews / (Positive Reviews + Negative Reviews)]. The Red line only calculates the rating from the past 12 months of data. It's slightly different than Review Signal's actual calculation because I am not filtering out duplicates for quick analysis. The difference for A Small Orange is that when you remove the duplicates, the year 2015 had a 43% rating indicating there was quite a few people writing multiple negative things about A Small Orange.

Sometime in 2015, the A Small Orange that thousands of people trusted and raved about became another EIG brand. I tried to get the inside story. I reached out to the former CEO who sold the company to EIG and became an executive there for a couple years post acquisition. He reached out on my behalf to EIG's PR team to see if they would participate in this story. Both declined to participate.

So, I'm left to speculate on what happened at A Small Orange based on what's been publicly stated by their CEO and watching their strategy unfold for years across many companies/brands. My best guess is EIG finally got involved with A Small Orange. They used to be a distributed/remote team, now all positions they are hiring for are listed as in Texas (their headquarters). I saw a HostGator representative get moved over to ASO's team, so the internal staff was changing and people were being moved from brands with less than stellar reputations to ASO. The former CEO left mid-2014, which likely left a leadership and responsibility gap. ASO could probably run on auto pilot through the end of 2014, but over time having no champion for your brand in upper management eventually will come back to hurt the brand when decisions get made based on simple economics.

Once 2015 rolled around, the service had noticeably declined. The overall rating for A Small Orange in 2015 was 43% (only using 2015 data). For years, they had been in the 70's. It also ended the year with a massive outage for most, if not all, of their VPS customers which has been going on since Christmas. I personally received multiple messages from users of this site asking about what was happening and alerting me to this decline in service quality.

ASO was also responsible for the Arvixe migration that went very poorly and caused the Arvixe brand to tank. I'm not sure why EIG doesn't have a dedicated migration team to handle these type of moves considering how many acquisitions they go through and how large a role it plays in their growth strategy. But that's a whole separate issue.
It's with great disappointment that I have to admit, the A Small Orange that played such a huge role in the founding and success of Review Signal and provided a great service to many thousands of customers is dead. It's become another hollow EIG brand where the quality has gone down to mediocre levels. And that seems perfectly ok to them, because it's probably more profitable for their bottom line.

Going Forward

This story has had a profound impact on Review Signal. One thing that it made painfully obvious is that the ranking algorithm needs its first update since inception. The current ranking treats every review equally. Which was great when this site launched, because time didn't have any opportunity to be a factor yet. But as this site continues to move forward, I need to acknowledge that a significant amount of time has passed since launch and today. A review from the beginning of Review Signal isn't as relevant as one from this past week in determining the current quality of a web hosting company. A Small Orange right now shows up around 64% which is artificially high because of their long history of good service and it hasn't been brought down yet by the marginally small (by time scale) decline of the past year. But it's painfully clear that it's not a 64% rating company anymore.

Another thing to note is the graphs here all used a simpler calculation [Pos / (Pos + Neg)] to calculate rating without duplicate filtering. What this means is the difference between the rating here and the actual rating on the live site is a measure of the degree people are being positive or negative about a company. If the rating here is higher than the published, it means people are saying on average, more than one good thing about the same company. If the rating is below (as is in most if not all cases here), it means people are are saying more than one negative thing about the company. I'm not sure if this will factor into a new algorithm, but it is something to consider. My intuition says you would see it hinge around 50%, those companies above would likely have more positive supporters, and those below would have detractors.

In the coming months I will try to figure out a better way to generate the ranking number that more fairly represents the current state of a company. My initial thought is to use some sort of time discounting, so that the older the review, the less weight it would carry in the rankings. If anyone has experience working with this or wants to propose/discuss ideas, please reach out - comment here, email me, or tweet @ReviewSignal.

Hurricane in the Cloud: How Hurricane Sandy Impacted Web Hosting Companies

I thought it would be really fun to create an infographic about the effects of Hurricane Sandy on the web hosting companies we track. I learned my infographic skills are optimistically rated: very poor.

So here's the interesting stats and trends we saw occur during Hurricane Sandy:

418 People Tweeted about Sandy and a web hosting company.

119 of those Tweets were talking about Intel's Sandy Bridge technology

15 People were concerned about their web hosting

7 (/15) of those people were worried about Amazon

23 People Claimed to have issues related to Sandy

8 (/23) of those complaints were directed at BlueHost

The Most Popular Sandy Tweets:

"Unsure why Heroku is prepping for Sandy. I thought hurricanes were the strongest kind of cloud." - @tenderlove (42 RTs)

"Linode HQ weathered #sandy only to lose power hours later, late last night. It runs our VoIP phones so no calls until we can work around." -  @linode (15 RTs)

"Laughing Squid founder @ScottBeale is live tweeting post #Sandy recovery from Manhattan. Follow him updates: https://twitter.com/ScottBeale" - @LaughingSquid (9 RTs)

Some Angry/Happy Tweets:

"@GoDaddy UMADBRO?????? UMAD?!?!?!?!?!? I HOPE SANDY COMES AND DESTROYS ALL YOUR SERVERS." - @djdarrenmallett

"With Gawker, HuffPo and others experiencing outages, Sandy is IRL the equivalent of GoDaddy hosting." - @spydergrrl

"wow how in the hell did @linode have 100% uptime in Newark during #Sandy? that's some badass hosting right there." - @procdaddy

"Wow, so Jersey is getting HAMMERED by Hurricane Sandy right now, and yet my @linode in Newark is still up. THAT'S service right there!" - @bill_clark

Other stories we found in the data:

Heroku released regions to help deal with customers who might potentially be affected by Sandy.

We saw BlueHost decided to offer flexible payments to those affected by Sandy.

Finally.

For your entertainment.

You can see my first ever attempt at creating an infographic (in the future, I will hire someone else to design these!)

image