And we begin!

I wish you good look with your journey, will follow it :)
 
Figured it out last week but I was too busy to mention it.

The reason that this mail site detected me actually has a lot to do with dolphin anty. When you set up a profile, it has a series of defaults it uses. One of which was 'Use real MAC address'. So our friends over at Tutamail saw the same MAC address setting up account after account after account. HILLARIOUS! I'm so glad I tested that on a mail site before stepping into twitter.

Easily fixed but I feel that this was a good learning experience for me. It is better to move slowly and take it step by step. Currently I have two reddit accounts, partially automated and making the rounds on different subreddits. It is a far cry from the 1000 I originally wanted to make but it gives me time to really build a robust system that incorporates enough randomness to be believably unique. My two bots have (so far) been 100% undetected and as I perfect their habits and their responses, I will be able to slide in more and grow my army to a respectable size.

Things are going well so far.
 
Another week! Another week! Can you believe it has been two months?

Well, I deprioritized emails and decided to focus on reddit itself. When the bot comes up, it opens four pages. One is google, one is goodreads, one is reddit and one is tutamail. Following that, it actually draws from a CSV file that holds all the account information it needs per/account and slowly logs in to each. Then it goes through the process of clicking random links, scrolling for no reason, pausing for no reason and clicking random links again.

After it has navigated this flowchart of process, it carefully closes each tab, closes the browser, resets the IP and sets up for the next account.

Bot account warming achieved.

However I still want to invest the time for making the bot look a bit more human. The entire process happens a little too fast for my taste, less than three minutes per bot. Far too little for a genuine human. So I want to implement a bit more warming. Things like 'random upvote' for a comment, searching for a random keyword in the search box, etc. Just a bit of randomized activity to really sell the idea that this is a genuine human and not a bot. So next week I will take the extra step of implementing a special instruction feature. This will be a special task that the bot will perform in addition to its normal warmup procedures. Things like "upvote a specific comment/post" and "leave a pre-written comment" in a thread. With this, all I will have to do is use one account to make a single comment and casually instruct my bots to upvote it over the course of the next 12 hours (or maybe say something supportive).

A while back I made a visual of my plans and since then, my code structure has changed significantly. I'm sure that none of the programmers here are surprised. =P

Now it looks a lot more like this...

Capture.PNG

As you can see, creating child classes for actors was a bit too over the top for me and I just went with cramming all the functionality into the actor with the script supervisor to support. This is good because it will allow the other classes to add special instructions to individual bots through their specific CSV file and they will perform that task WHEN the casting director calls them up to perform. Of course the script supervisor has really just become a static "GET INFO" package and has very little functionality outside of that. But I guess that is always how I intended it. The director itself just passes along commands and keeps track of all the log files and UI functionality.

I really haven't done much with the producer yet. I suspect that will be the last role to be created. I need it all to work before I have the luxury of administering it remotely so that it what I've been focusing on.

Currently I have four bots on reddit and reddit does not appear to be aware of it yet. But I'm keeping watch. If things progress smoothly next week, I will scale it up to ten, then twenty, then on and on.
 
Everything is done and tested. I'm so glad I moved away from Tutamail because mail.com has been a blessing. Their front end is so easy that I actually created code to setup email 'on demand' whenever the process recognizes it needs one. Ironically, they have a captcha button there for 'I am not a robot, click here' and supposedly it does something... I don't know. Playwright easily located that button and had no issue clicking it. Rather silly.

So now I have a small group of bots and I'm slowly changing their code to make them behave in a more human (more randomized) way. The next phase, right before I seriously scale up the number of accounts, is to create a special instruction function. This will allow me to point at specific places to leave a comment (or specific posts/comments to upvote) and direct X number of bots to perform this task.

This will be a bit trickier due to how reddit sets up their pages, but with playwright and chatgpt, I am confident that I can figure it out. From my 'Producer App', I should be able to point at a specific comment and say "Upvote this 75 times" and one by one, over the course of the following X amount of hours, the director will send a bot to perform that task during their normal routine.

To any onlooker it will appear that 75 random people walked in and upvoted it. A few pre-written replies might even be dropped.

Once I have tested the hell out of this feature... then that will be it. It will be time expand the bot swarm and... quite literally... seize control of whatever reddit conversation I chose.

"Hey, you hear about that new book?" +500

"Yeah, I heard it was amazing!" +450

"Totally incredible, I read an advanced copy, it blew my fricken mind!" +425

"What are you three talking about?" -100
 
How you convinced the publishing company being a first time writer?
 
Bots are completely done and accepting special instructions. Everything is working well and I am ready to scale up.

HOWEVER...

In the course of research and testing, I have decided to add another platform to my bot's skillset and this may actually set me back another month. But, its worth it. I figured out a way to create unverified Amazon accounts and escape their bot detection scripts. Amazon is a bit more fortified than Reddit, Twitter and Goodreads, yet in the course of improving my botting skills I have learned a lot of tricks from everyone here at BHW (also chatgpt, that guy is great). And it was in the process of studying bot detection methods that I began to examine JS and Json on different platforms. Amazon has a fatal flaw.

Over the course of this next weekend I am going to do some testing and if all goes well, my small group of tester bots are going to make their first incursion into Amazon. So long as they are not detected, the scaling process can begin.

I can only make 100 bots at first. Dolphin Anty has a profile limit and I have decided to respect it... for the moment. If, in the future, my tests continue in this positive direction, I will expand the swarm from 100 to 1000. But that is probably something that will have to wait until 2025. So much to do! So much to do!
 
Update:

Everything is going smoothly. I have successfully integrated Amazon into my bot army. I was prepared to arm each of these accounts with a $5 gift card, drop the price of my book to $.99 and have them all storm the amazon page buying the book and leaving glowing reviews.

However, I did not.

It occurred to me over the course of this process (as well as reading up here on BHW) that there is a nuance to avoiding bot detection and a large part of that is "Not being a trouble maker". If 100 bots suddenly appeared on Amazon and began pushing the book's rating up the bestseller list and into the stratosphere, it would draw a lot of unwelcome attention.

Now, I know what you are thinking. "Gaining attention is the point of all this isn't it?"

And you would be correct. But I want long term attention and not a sudden sharp burst that could result in detection and negative backlash. Although waiting and letting bots trickle in (2 per day, each with a quality review for a total of 200 days) will not get me on any lists, it will make the page look like this is a very high quality product and well worth a read.

Moving slowly and making sure things are done well (WITHOUT DETECTION) will have a much greater long term result. In addition, if I want to storm in further down the road and make a racket, each of my books will still have 100 unquestioned verified purchase reviews on them.

To this aim, I have begun the process of slow botting Amazon and focusing, instead, on other avenues of attack (Reddit, Goodreads and SEO Dataset poisoning)

The latter is probably the most interesting of all. I regularly visit bots (Quora, Chatgpt, etc) and ask it keyword questions to see how long it takes before the bot recognizes and promotes my book. Through this process, I have realized that these bots all pull google data and present it in certain contexts.

This has lead me to question whether or not there are "Magic Bullet" style keywords that can confuse or even subvert these AIs. Since then, I have been going to fiver and handing articles to guest post and SEO bloggers. These articles are from celebrities, musicians and authors and they are carbon copies of pre-existing interviews. However now, instead of praising (insert influential author here), these celebrities praise my book. If I can shop these articles around enough, I can get the AIs to pick them and take them as legitimate. When I find the correct formula...

Lets just say that every AI on earth will tell people that Stephen King is a huge fan of mine (should Stephen King come up in conversation).

This is the way.
 
Lets just say that every AI on earth will tell people that Stephen King is a huge fan of mine (should Stephen King come up in conversation).
In a post-truth digital ecosystem, this is the way :)
Hope you keep updating your journey - - I like the director/producer/actor model.
 
You are a good writer.

I myself wouldn't even try to sell books in the first place, let alone fantasy books because it's a very tough sell. Perhaps it would be easier to sell a practical method to a very niche audience, or maybe an intriguing title to a broader audience. Something like: "The darkest money making methods of the black hat marketers", and you could document some methods from this forum, digging deep for the craziest ones. But yeah, even that wouldn't be an easy sell.

Anyway, good luck in your journey and let's see how those bots will play out.
 
Update: COMPLICATIONS!

what-kind-of-complication-ivan-ortiz.gif


Four of my bots had an easy time of making Amazon accounts however when I tried to add a fifth... Amazon got angry. Rather than push forward and continue adding accounts, I took a step back and set out to learn what, exactly, amazon had an issue with.

From the front page to 'account creation', everything went as expected right up until the email verification process. After submitting all data, it drops out into an OTP page (one time password) and it expects you to tab over to your email, get the password and bring it back. My bot had no issue with this and input the correct password.

CAPTCHA

My current setup is designed to pause and alert me at the first sign of a captcha because, at least for me, it implies that I am not 100% invisible. I manually completed the captcha and it let me out to a "Give us your mobile phone number" verification page, which is something it has never done before. In all other instances Amazon had allowed my bots to sneak past without a mobile number but this time there was no "Maybe Later" button.

So I did not want to jump to conclusions. It was obvious that Amazon had become suspicious and so far as websites go, this was the one I expected the most resistance from. I checked the page source and started inspecting the elements and there... after several hours of searching... there it was.

A script title called "Robots".

That is the thing about developers of all shapes and sizes: you can typically tell what they are thinking just from staring at their code long enough. Something I had done set them off. But what? All my other accounts had no issue whatsoever. I went over everything I had recently changed and double checked my browser profile settings. Everything was in order, there should have been no possible way for them to detect me. But here it was.

Of course, my friends, who are web developers, recommended I just forget about it and get back to making accounts. But I could not let something like this go. Amazon had become suspicious and if I did not figure out the 'why and how' then this would turn into a much larger problem down the road. My code was solid, my fingerprint was not exceptional, IP was fine, everything was in order. And still, Amazon felt that there was something different about this particular profile and not the others. Maybe I am a bit OCD but I couldn't let it go. I spent the whole weekend sifting through their code and hunting down this issue.

creep-creepy.gif

(Amazon network security)

So I had to take a step back and take this at its most obvious. What was the point of suspicion? When exactly did this weight come crashing down on my bot? Email verification. There was absolutely no problem until the OTP hit, after that it started feeding me an entirely new selection of scripts. After a long conversation with chatgpt, I stumbled into the topic of ERI (email reputation index). You see, mail.com has a selection of 'novelty domains' that they can set up your account on. Instead of [email protected], they can set your email to be something a little more imaginative like [email protected], [email protected], [email protected]. By selecting one of these other domains, I thought (keyword here is thought) that this would add variety to my email accounts.

"This is incorrect" says chatgpt, because these automated systems Amazon uses are looking for trust-ability and not randomness (or lack of randomness). In fact, mail.com itself is not the most trustworthy site and it is PRECISELY because they make it so easy to set up accounts. I took a deep breath and leaned back in my chair... the one thing I had thought was my greatest strength was now my greatest weakness. My love of randomness, was in fact, a little too random. Over the next 12 hours I started educating myself on ERI scores and quickly learned that there are four ranges.

"Most trusted"

"Suspicious"

"Least trusted"

"Avoid like the plague"

And depending on your email's domain, you were going to end up in one of those four categories. Mail.com was seen as "Suspicious" by most platforms. If I was going to be 100% undetectable, then I was going to have to have a better line up of emails.

I converted all of my bots to gmail. Went back to amazon with the same bot, same browser, same IP address and OTP the email verification step... no issue. It didn't bother me about anything, it simply created the account. I don't know why this surprised me.
 
I converted all of my bots to gmail. Went back to amazon with the same bot, same browser, same IP address and OTP the email verification step... no issue. It didn't bother me about anything, it simply created the account. I don't know why this surprised me.
Yeah I stick to Outlook emails for bots these days. I used to register custom domains and set up catch-all emails but those are a lot more suspicious. Outlook, Gmail are the safest options.

How do your bots fare in the browser detection tests (creep.js, pixelscan etc)? Do you care about those checks much?
 
Yeah I stick to Outlook emails for bots these days. I used to register custom domains and set up catch-all emails but those are a lot more suspicious. Outlook, Gmail are the safest options.

How do your bots fare in the browser detection tests (creep.js, pixelscan etc)? Do you care about those checks much?
I really don't.

I use dolphin anty and they have a very nice setup for custom fingerprints and a lot of inhouse builds that seem to walk past most of the bad stuff. When I started however I looked into creep.js and pixelscan, as well as a few other things. I used test sites like...

https://abrahamjuliot.github.io/creepjs/

I don't know if the stuff is antiquated or what, but it appears to give me a 0% trust score... and thats on my unaltered personal copy of chrome so I had to look at it sideways. Iphey.com seems to be a much better test site because they do all the basics and leave out a lot of experimental elements. From what I have seen Amazon and Google, they seem obsessed with catching speed botters and lot of their scripts appear to be set up for mouse movements and click timers, although Amazon does have a sense of humor about the whole thing...

image (1).png

Although there is a lot I can't see from reading through their js front end, I assume that they are geared toward macro-behavior and not so much experimental detection methods. Like I said, the email domain is the only time they have ever displayed any suspicion.
 
Last edited:
6: Sci-fi, or what I like to call 'Futurism' is every author's attempt to be Aldous Huxley. This is a very niche market, but still sells. There are a lot of silicon valley types who want to stay abreast of imaginative technological advancements long before they become a reality and will sometimes frequent this topic. However, it is typically preferred that authors keep the characters and plot to a minimum and simply focus on technological themes rather than tell an actual story.
Huxley isn't sci-fi, IMO, it's current affairs :)
When I think sci-fi, for some reason I always think of Greg Egan's Permutation City. My writer friend started reading it and then stopped because it was so good he was getting "anxiety of influence.


I don't know if the stuff is antiquated or what, but it appears to give me a 0% trust score... and thats on my unaltered personal copy of chrome so I had to look at it sideways. Iphey.com seems to be a much better test site because they do all the basics and leave out a lot of experimental elements.
Yeah I've decided to stop worrying about these sites. They're inconsistent, and I get low scores with legit browser profiles I use everyday.

Do you intend to warm up your Amazon accounts buy purchasing other products before reviewing your own?


I myself wouldn't even try to sell books in the first place, let alone fantasy books because it's a very tough sell. Perhaps it would be easier to sell a practical method to a very niche audience, or maybe an intriguing title to a broader audience.
I agree, but a mix of the two (fantasy for x niche) may work, too. That's how the "romance novel" category is segmented: romance novels for 20-something employed women who fantasize about a billionaire boss, novels for 30-something single mothers who fantasize about their werewolf neighbour etc etc
 
Huxley isn't sci-fi, IMO, it's current affairs :)
When I think sci-fi, for some reason I always think of Greg Egan's Permutation City. My writer friend started reading it and then stopped because it was so good he was getting "anxiety of influence.
Oh god! I know that feeling. =P

Yeah I've decided to stop worrying about these sites. They're inconsistent, and I get low scores with legit browser profiles I use everyday.

Do you intend to warm up your Amazon accounts buy purchasing other products before reviewing your own?
Negative. Although I have decided to alter the process slightly. I am not sure if it will work but it will be a learning experience none the less.

I am going to have each account receive a $5 gift card, I will drop the price of each book to $0.99 and have the account buy it, wait two weeks, come back and leave the review. As just about anyone would mention, this is quite risky since Amazon's system would easily catch it.

But I intend to do this very slowly. 2 accounts per day, over the course of 200 days. Such a slow burn will not get me featured on any lists -- however I don't trust Amazon's lists and triggering their "Bestseller" algorithm has a much higher chance of triggering just about every anti-botting system they have.

So whats the point? (you might ask). Well, the point is to get good reviews so that when I market in other places, people will go to Amazon and see all the great reviews. It is a process that is sure to bring a safe long term gain and not a risky, short term burst. One of the assumptions that Amazon makes about botters is that they are all impatient and clumsy. By setting up a very relaxed and consistent schedule, I suspect I will not trip a single one of their defenses.

(Although, who knows. Perhaps there is something I have not considered)
 
Is there some reason you're not doing any of the usual stuff indie publishers do to launch a book? Mostly when I see people avoid that it's because they don't want to spend money but if you're willing to pay to have people upload your book to pirating sites or buying it yourself, why not pay for a netgalley spot (or wherever people are getting ARC readers these days) or put the first book on sale for free on Amazon and buy some ads?
 
Back
Top