{"id":1595,"date":"2017-03-31T05:17:51","date_gmt":"2017-03-31T09:17:51","guid":{"rendered":"https:\/\/reviewsignal.com\/blog\/?p=1595"},"modified":"2017-07-18T17:15:15","modified_gmt":"2017-07-18T21:15:15","slug":"uncovering-the-rose-hosting-spam-network-on-quora","status":"publish","type":"post","link":"https:\/\/reviewsignal.com\/blog\/2017\/03\/31\/uncovering-the-rose-hosting-spam-network-on-quora\/","title":{"rendered":"Uncovering the Rose Hosting Spam Network on Quora"},"content":{"rendered":"

Welcome back to Dirty, Slimy, Shady Secrets of the Web Hosting Review (Under) World - Episode 3!\u00a0Read Episode 1<\/a>\u00a0| Episode 2<\/a><\/strong><\/p>\n

Today's post features Rose Hosting. Who I refuse to link to because their whole business model seems to involve comment spamming this blog and other sources of information. What started with a simple spam comment sent me\u00a0down a rabbit hole I wasn't prepared for and shed light on a fairly large spam operation that spanned multiple sites, but my primary focus became Quora with a secondary focus on the web hosting review sites also being manipulated.<\/p>\n

\"\"<\/a><\/p>\n

Visualization of Rose Hosting Quora Spam Network. An interactive version is available at the end of the article.<\/em><\/p>\n

The Beginning<\/h3>\n

It started with a simple spam comment.<\/p>\n

\"fakereview1\"<\/p>\n

The poster tries to compliment the post and then drops in a RoseHosting mention and praises it.<\/p>\n

But wait, there's an IP address! Looks like they made a mistake this time.<\/p>\n

\"oscarstanley-arin-ip\"<\/p>\n

So Miami Cloud Hosting is who owns the IP space that this comment came from. Let's see what comes up when I ping rosehosting.com<\/p>\n

\"rosehosting-ip-ping\"<\/p>\n

If you go to that IP, rosehosting.com shows up. So it's correct. Also if you look at their DNS<\/a>:<\/p>\n

\"rosehosting-dns\"<\/p>\n

So we're 12 IPs away on that A record. Let's check out that IP that actually responded on ARIN.<\/p>\n

\"rosehosting-arin-ip\"<\/p>\n

Bingo. Same Miami Cloud Hosting.<\/p>\n

So fakeish looking name, an email with zero google search results and coming from the same IP space on a the cloud hosting provider that hosts RoseHosting. Pretty damning, but unsurprising to see some astroturfing, many of the bigger players just rely on affiliates to do it for them and look the other way.<\/p>\n

But I'm not one to accept shitty behavior in this business and just look the other way.<\/p>\n

Digging Deeper<\/h3>\n

Let's see how many more I can dig up. I recognize the Rose Hosting name and know they've spammed me in the past.<\/p>\n

\"jean-debushy-comment\" \"mike-hidemyass-comment\" \"pablo-comment\"<\/p>\n

\"mateo-comment\"<\/p>\n

 <\/p>\n

The pattern seems to be emails with nothing associated with them on google. There is a protected twitter account with the same username as Pablo, but that's about it.<\/p>\n

Mike uses HideMyAss, a VPN service designed to hide identities. VPNs\/anonymity have a lot of value, they also happen to be abused by spammers a lot. This pattern looks nefarious.<\/p>\n

Jean's comment follows the original Oscar comment's template: compliment, rose host spam, compliment.<\/p>\n

They all added in HTML with the rel=\"nofollow\"<\/em> because they probably realized Google can easily see comment spam and cracked down on it. Putting a nofollow link is supposed to preserve your SEO value by not associating it as a spam link (because it's telling Google not to follow it). Why are these supposed customers adding SEO tactics to their comments and trying to hide their identities?<\/strong><\/p>\n

The Boss Man<\/h3>\n

I also got this email from Bob, who I assume is the owner based on what's listed publicly and the interviews he's done on at least one other review site which I don't trust a bit, and won't link to either.<\/p>\n

But it's all class, I want to get listed and pay a lot.<\/p>\n

\"generous-affiliate-program-rosehosting\"<\/p>\n

So at best they are a 'subtle' please promote me for money kind of web hosting company (which almost every host will do). At worst, they are comment spamming and potentially astroturfing\/sockpuppeting web host.<\/p>\n

Searching For More<\/h3>\n

I searched WebHostingTalk<\/a>, the largest web hosting forum that has run forever and has over 9 million posts.<\/p>\n

\"rosehosting-wht\"<\/p>\n

Just\u00a0about everyone is talked about here. They have a company account that constantly posts ads. But how is it that in 14 years there are only 2 reviews and most of the threads are asking 'who?' Yet somehow, my blog is getting hordes of accounts recommending them. Another red flag<\/strong>.<\/p>\n

Did they learn their lesson on WHT when an account got questioned<\/a> about sounding like a shill? So the largest forum with 9,000,000 posts has basically nothing about them.<\/p>\n

I kept searching and stumbled upon this gem on Twitter<\/p>\n

\n

.@RoseHosting<\/a> Stop spamming my website with your tutorials; leaving comments about my tutorials and then linking to your website's tutorial.<\/p>\n

\u2014 Brandon Himpfen (@BrandonHimpfen) August 30, 2015<\/a><\/p><\/blockquote>\n