Vote manipulation bots using sh.itjust.works?

Hi just a heads up. Check out this post: https://sh.itjust.works/post/37758799

It got so many upvotes in a such a short time I checked out its activity from an mbin instance. And most of these upvotes are coming from sh.itjust.works accounts which were all created 2 months ago, most on 2/16, and have never posted/commented. There was a similar post in the lemmy.world/c/world community linking to the same website and having a similarly high number of upvotes within minutes, but that post seems to be gone now.

19 comments

Yes that does look like vote manipulation. Thank you for notifying us. Those accounts will be banned.
- I’m glad that this is something that Lemmy admins appear to actually care about and have the capability to investigate.
- Awesome!
  Is this something that we could have a script for? I imagine this isn't the last time this will happen.
- superstar

good fucking catch

Thank goodness for the open platform that Lemmy is. It’s nice knowing that these things can be caught so easily.
- Though it’s a bit of a confirmation bias. Only the ones we caught are those we know about.
  I won’t detail how, but it would be pretty trivially easy to make it much harder to catch. This is just utter laziness on behalf of the vote manipulators.
  I think a statistical analysis that looks at what accounts nearly only upvote the same comments or posts as another account would probably be the DIY gold standard for catching vote manipulation on the lemmyverse.

thanks for flagging this, i just banned 346 accounts involved in this scheme from lemmy.world :|
(unbanned at the time of creating the report) accounts posting links to the same domain:
4x sh.itjust.works
2x ani.social
1x thelemmy.club
1x lemmy.ca
accounts i'm highly confident were involved in vote manipulation here:
172x sh.itjust.works
22x ttrpg.network
21x lemmings.world
20x discuss.online (banned by me)
19x lemmy.wtf
18x lemmy.myserv.one
18x leminal.space
18x ani.social
16x endlesstalk.org
7x lemmy.ca
4x lemy.lol
1x toast.ooo
1x startrek.website
1x lemm.ee
- Thanks for taking action! That's a pretty crazy number of accounts to set up for what appears like promoting a few bland articles from a bland AI-generated website.
- Really appreciate the effort that went into compiling this. Those leminal.space accounts have been banned.
- Wow that looks productive. I’m assuming you can’t share the methodology for linking these accounts to help combat this stuff but I’m very curious if that isn’t an issue.
  
  essentially start by identifying the accounts posting links to the domain in question, then analyze the voting behavior of the accounts upvoting these posts. you can start by sorting out accounts that have legitimate activity and then narrow it down further and find common patterns that only apply to these accounts.
  most of them were also created in similar time frames.
  edit:
  to extend on this, once you have something to go on with it's fairly easy. the hard part is finding something that applies in a more generic way to identify this happening before someone else discovers unusual voting patterns and reports them.

Good catch. I linked this post in the comments of that other post you linked, and it looks like the moderators have since removed the post entirely.
There was another one linking out to that same site (maybe the other post you saw as well) which I recall had an extremely misleading clickbait-y headline. It also seems to have been removed, so at least mods are staying on top of it.
Does Lemmy have the ability to automatically block/remove posts leading to certain domains? Seems to be a common thread of these accounts trying to promote this one "news" site. Though I don't imagine this sort of thing will stop at one site.
- Was that the one about Biden lying?

Good catch. I just checked the posts votes, there's an insanely huge amount of SJW users, all accounts created on 7, or 3 months ago. Completely empty accounts, too...
Edit:
Cickbait title. Unable to verify reliability of source. News organizations should have a verifiable presence outside of their website such as a physical address, Wikipedia entry, etc. Please share from a reliable news source.
Got removed by mod. Odd but i still have the username anyway.

Wait, I want to read the propaganda!
- I kind of do too… anyone have a link to what it was before it was deleted? I am curious.
  @admins thank you for squashing this ❤️
  
  It was just a random site with some news articles. Nothing objectionable content-wise really. Only the remarkable number of upvotes in a very short time for two posts going to the same random site stood out to me.

19 comments