Persistent fake engagement by coordinated multi-account operation

  • Unknown's avatar
    officialaptivi · Member ·

    Hello,

    This is the Aptivi Blog operator.

    I’m reporting a persistent engagement-farming/spam operation that has been targeting my blog, which has over 1,700 posts. It has been ongoing for over a year, and I’m posting here after exhausting all removal options, as this behavior continued even after I removed the engagement-farming accounts from the subscriber list multiple times.

    After further investigation from my side and looking at my old e-mail history, I found that the following WordPress.com accounts have been involved in this operation:

    • Video Game Review: this account subscribed to my blog on February 20th, 2025
    • estoreknight: this account subscribed to my blog on February 19th, 2025
    • techwordly: this account liked one of my blog posts for the first time on July 29th, 2025, yet didn’t subscribe, so I don’t have their mail address

    The reason I’m reporting those accounts is that because I’ve observed coordinated account activity from those three accounts. I’ve observed that they’re trying to like every post in my blog by digging through the archives, according to their actions, even after they’ve been removed from the subscribers list.

    I thought that they’d stop midway, because it’s been over a year since I’ve been getting notifications about them liking my old posts, but they didn’t stop. That’s when I started investigating the matter.

    I’ve already removed those accounts from the subscribers list, but I can’t seem to find “techwordly” anywhere, and I presume that they have never subscribed to my blog. I’ve later discovered that “Video Game Review” has subscribed to my blog again yesterday, so I’ve removed them again only to later find out that the same account has subscribed to my blog yet again. I’ve later discovered that estoreknight and techwordly didn’t subscribe to my blog anymore.

    Today, I got two notifications that said that “Video Game Review” has liked two of my old blog articles, which were published on August 13th and 12th, 2025. Upon opening the affected articles, I’ve discovered that all three accounts I’ve mentioned above have all liked the post simultaneously! I know that independent readers don’t accidentally like the same old post at exactly the same moment, and that it’s a confirmation that those accounts are being operated by either a single person or an automated system.

    Note: I’m not requesting that action be taken against their sites themselves, as they are hosted outside WordPress.com with WordPress.org, and that I recognize that WordPress.com isn’t responsible for self-hosted websites with WordPress.org.

    So, I’ve investigated two of their sites that are self-hosted with WordPress.org (estoreknight and techwordly) on an incognito browsing session, and discovered that:

    • techwordly has a blog that posts tech news, but last activity on the site was on February 19th, 2026.
    • estoreknight has a tech “shopping” website, and last blog post was on April 8th, 2023 by “Rbloc”, with AI-generated articles (because the most recent post said “As a language model, I do not have personal experience using the camera…”).
    • “Video Game Review” has no website.

    While investigating the estoreknight site, I’ve discovered that the following PHP warnings have shown up:

    Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the woozone domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/videoga9/Estoreknight.com/wp-includes/functions.php on line 6131
    Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the woodmart domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/videoga9/Estoreknight.com/wp-includes/functions.php on line 6131

    Further investigation showed that:

    • The server path for the self-hosted site starts with /home/videoga9/Estoreknight.com, and “videoga9” points to something interesting, because it tells me that it’s hosted by the same person as “Video Game Review”.
    • The WooZone plugin was used in an attempt to drive traffic to their site to earn Amazon affiliate commissions with fake engagement tactics (liking my old posts persistently to get me to visit them), which makes the site more of an Amazon affiliate site.

    I believe that their accounts on WordPress.com need to be investigated (“Video Game Review”, estoreknight, and techwordly), that appropriate action be taken against these accounts, and that their email addresses be flagged to prevent further resubscription attempts from them.

    I’m happy to provide evidence (notification logs, screenshots, email addresses of the two accounts I obtained from the subscription mails, etc.) or answer further questions upon request.

    Thanks in advance.

    The blog I need help with is: (visible only to logged in users)

  • dhruvikmalaviya · Staff ·

    Hi there! Thank you for sharing all of this, I can see you’ve put a lot of effort into investigating the issue, and I understand how concerning this ongoing activity must be.

    Before we take this further, I’d like to confirm a couple of details so I can guide you correctly:

    • Are these likes currently still happening on your site, or has the activity slowed down recently?
    • When you remove the “Video Game Review” account from your subscribers, does it reappear immediately, or after some time?
    • Are you noticing any comments or just likes from these accounts?
    • Could you share links to 2–3 example posts where you saw multiple likes happening at the same time?

    Once I have this information, I’ll be able to better determine the next steps and involve the right team if needed.

  • Unknown's avatar
    officialaptivi · Member ·

    Hello,

    Thank you for the response! I’ll address the following points:

  • staff-webwizard · Staff ·

    Hi there,

    Thank you for taking the time to compile all of this information and for the detailed report.

    I’ve relayed the details you’ve shared to the appropriate team for review. Please note that for privacy reasons, we won’t be able to share specifics about any actions taken regarding other accounts.

    If you notice this activity continuing, don’t hesitate to follow up here and let us know.

  • Unknown's avatar
    officialaptivi · Member ·

    Hello,

    Thanks for the reply!

    I’ll keep monitoring my blog for continued activity, and I’ll give you an update to let you know, should the activity continue.

    I’m ready to answer any further questions! 😊

Log in or create an account to reply