How do you deal with fake product downloads from bots (Chrome Web Store, Play Store, AppStore)?
Over the past week, several Chrome extension owners (myself included) have experienced a rather unusual situation.
Bots apparently operating from Romanian IP addresses are mass-installing extensions, but the number of active users remains completely unchanged.
There is a suspicion that this is part of a coordinated wave of malicious activity where bots:
Mass-install extensions and then uninstall them shortly afterwards, potentially hurting their relevance and ranking in the Chrome Web Store.
Some creators have already excluded Romania from their list of available countries.
Have you ever experienced anything like this?
I'd love to hear from anyone who knows how this works, what the potential consequences are, and how to protect their products from this kind of activity.
Replies
Hello Nika,
Thanks for bringing attention to this issue. I just realized the same problem unusually excessive install from Romania. I think it's best to investigate it and if necessary report this issue to Google support. Something is definitely amiss here. The investigation from my extension shows that it's likely a bot and not an attack per-say. I think it's a sandbox test from a security vendor or threat crawler. My suspicion is Bitdefender which is headquartered in Romania. Other possible source could be someone studying your extension in order to clone or impersonate it.
Do you also see a lot of install by OS as Other rather than ChromeOS or Windows?
@richatsealedvault But what is that strategy good for? I had "other" installs.
@busmark_w_nika Not exactly sure the advantage of that strategy but I do know several security research companies go on phishing expedition to see what they would find.
@smiteshrmore Where do you report it? Do you have a contact? I would do the same so maybe when the case multiplies in the number of "victims" they will be more likely to pay attention.
@busmark_w_nika, you can report the issue using the Chrome Web Store Developer Support form.
Choose the category that best matches your issue, such as Analytics and Traffic Anomalies or Report a Problem (or the closest option related to store policy or security), and provide as much detail as possible about the unexpected traffic, performance issues, or suspected fraudulent activity.
AI Context Flow at the moment. What the fuck is happening here.
@hira_siddiqui1 I found more discussions on Reddit and still monitoring the situation:
1. https://www.reddit.com/r/chrome_extensions/s/mwV7n7wpT9
https://www.reddit.com/r/chrome_extensions/s/PjgtAvQQfJ
https://www.reddit.com/r/chrome_extensions/s/aqeDVz4ENY
Bot activity in general has increased to the point is massively more than human traffic. It's not malicious for the most part. Countries with low income and high technical expertise send a lot of bot traffic since it is a huge monetary incentive.
@richatsealedvault - My suspicion is Bitdefender which is headquartered in Romania.
That's a good example. It's unlikely just that one company - it's a pocket of knowledge on how to monetize with bots. Romania has large bot farming operations and this is likely another way to farm.
Reporting to the app store is probably the best long term solution.
Ya thats the same issue with me too Earlier It didn't happened It's happening recently on Chrome Webstore I don't Understand wth are Romanian Bots