Skip Navigation

Finding a Botnet on DevHunt

AIToolsTaskless
A crowd of small figures, most of them identical cardboard cutouts with a few real people mixed in. Under a magnifying glass the cutouts turn into empty dashed outlines, and only the real people stay solid.

At the end of October I launched Taskless on DevHunt, a launch board for developer tools. We finished #3 for the week with 59 votes and a comment thread full of good questions.

The two launches ahead of us had voter lists that looked strange, so after voting closed I started reading voter profiles. I ended up reading every voter on every October launch I could find, 265 launches and 787 voters. One group of 103 accounts stood out. They only ever vote for the same three launches, and those launches took two of October's four weekly #1s and a #2.

What the 103 accounts are

The first thing that seemed off was the ratio of votes to comments on the two launches ahead of us. Lots of votes, very little conversation. Then I noticed how many of the voter profiles showed only initials, which usually means the account never connected a social media profile at all. That's what got me digging.

What I found was 103 accounts that were effectively invalid. Each one signed up with a Gmail address, and any check that they were real people stopped there.

Bar chart of the three launches the 103-account network voted for. TwitterAPIs, #1 the week of Oct 13: 46 votes, 25 from the network. Articos MCP, #1 the week of Oct 27: 91 votes, 75 from the network. RedditAPIs, #2 the week of Oct 27: 82 votes, 69 from the network. Below, which launches each of the 103 voted for: 11 all three, 43 Articos and Reddit, 1 Articos and Twitter, 20 only Articos, 15 only Reddit, 13 only Twitter.

None of the 103 has ever launched anything or left a comment on DevHunt. Every vote they've cast went to TwitterAPIs, Articos MCP or RedditAPIs, and to nothing else on the site. Most of them went for one pair: 43 voted for Articos MCP and RedditAPIs, the two launches that finished #1 and #2 the week we launched. 11 voted for all three. Anyone in the group who voted for both TwitterAPIs and RedditAPIs also voted for Articos MCP.

Every one of them does list a profile link on DevHunt, so I checked all of them. 53 link an account that's suspended, gone, or plainly belongs to someone else, and 7 couldn't be read. The other 43 match on name, but 15 of those star at least 2 of the same 5 GitHub repos. So do 8 more from the group. 27 of their GitHub accounts star the most common of those repos, and no other voter on the week's top 5 does. Seven of the GitHub accounts were created in the second half of October.

I don't know who runs these accounts, and I'm not guessing. They behave as one group, though, and most of them are throwaways.

How it changed October

Those 103 accounts cast 169 of the 219 votes on their three launches, which is 77%.

TwitterAPIs was the #1 launch for the week of October 13 with 46 votes, and 25 of them came from the group. Take those away and it has 21, which puts it sixth for the week, behind shpyrd at 36. In the week of October 27, Articos MCP finished #1 with 91 votes and RedditAPIs #2 with 82. 75 and 69 of those came from the group. Without the group's votes, Articos MCP has 16 and RedditAPIs has 13. The group showed up in only those two weeks, and the winners of the other two got no votes from it at all.

Then I wanted to know whether the 103 were the whole problem, so I checked the linked profile of every other October voter too. Another 152 votes came from accounts with no activity whose linked profile is dead or belongs to someone else. 81 of those came from just 4 accounts in an agency's voting pool, which I'll get to below. The other 71 are scattered across launches, mostly one vote each, with nothing tying them together. Counting everything, 321 of October's 2,080 votes look fake, about 15%, and more than half of those came from the 103.

Bar charts of each October week's top 3 launches on DevHunt, split into suspected fake votes, votes we couldn't verify, and everyone else. Across October, 321 of 2,080 votes look fake. Week of Oct 6: OneProvider 76 with 15 suspected fake and 11 unverified, Respira for WordPress 67 with 5 and 18, Figma to HubSpot converter 63 with 6 and 13. Week of Oct 13: TwitterAPIs 46 with 26 and 1, shpyrd 36 with 2 and 16, WITAN Markets 31 with 3 and 11. Week of Oct 20: AI-Atlas 64 with 3 and 29, Supaboard AI 34 with 1 and 18, CapMonster Cloud MCP 29 with 4 and 5. Week of Oct 27: Articos MCP 91 with 75 and 4, RedditAPIs 82 with 69 and 3, Taskless 59 with 3 and 5.

Most of October's top launches picked up a few of these, which is about what you'd expect when anyone can make an account to vote. The hatched green is voters I couldn't check, mostly people whose only link is a LinkedIn profile or who link nothing at all. The network's three launches are the only ones on the chart where most of the votes look fake.

I ran Taskless through the same check, because I'd be a hypocrite otherwise. We're on that chart with 3 suspected fake votes out of 59, and none from the 103. A lot of our votes came from my own community showing up because I asked, and I'm fine with that.

The agency pool is 35 to 40 accounts voting for the agency's clients, mostly in the first week of the month. Most of the ones I checked by hand were people using their own names, and I can live with that. The 4 accounts with profiles that don't check out are the part I can't explain. The 103 are a different thing, though.

How I found it

DevHunt's voter data is public. Every voter's profile, every vote and every linked account is viewable, and an agent with browser access can vet a whole launch in an afternoon. That's how I did this. The pattern showed up once every voter's full vote history sat in one table: a block of accounts with no activity except votes, all for the same three launches. The aggregate data and method are in this gist.

What DevHunt did

While voting was still open, I messaged John Rush, DevHunt's founder, with what I'd found. John told me he'd remove the fake votes, and the final list came out unchanged. Articos MCP closed at 91 and RedditAPIs at 82, the same counts I'd recorded hours before the close.

After the close I sent John the full audit, then the list of all 103 accounts with their DevHunt IDs and linked profiles. When I sent him this post ahead of publishing, he wrote back: "im implementing a new antibot system with the help of JEV classification model. Gonna be live next week." As of publishing, the October votes are still counted, and the leaderboard still shows the same numbers.

If DevHunt wants a cheap place to start, it could stop counting votes from accounts whose linked profile names someone else. It probably shouldn't let you link suspended accounts either.

Why the signal matters

Developer tools have always had a hard time with discovery. Developers don't respond to ads, and you can't buy your way onto a team's toolchain. Launch boards were one of the few places a two-person company could put something in front of developers who were actively looking for new tools. When it worked, a good launch week told you something about what developers wanted.

It's fine when your friends show up to support you. When the voting is full of throwaway bot accounts though, nobody scrolling the board can use the signal from that week.

DevHunt is where I had the data, but I keep running into the same automation everywhere I try to get someone's attention. Conference CFPs now ask you to attest that your proposal isn't AI slop, and my inbox gets 10 to 15 AI-written pitches a day. Agencies, "growth partners," investors who aren't investors. Cheap submissions get automated, and the channels respond in different ways. The CFPs made everyone sign a form, which costs the people who write their own proposals. DevHunt did nothing, and its leaderboard shows it.

What still worked

The comment thread on our launch was the best part of the week. Kris asked whether old rules get edited by hand or regenerated. Jeremy Stanley asked how you decide between a rule and an LLM review, and what it does to build times. Others still asked about Taskless architecture. A few already using it (thank you Jared!) came to share their firsthand experiences with the product.

A question about build times from someone who actually ran your tool takes time and context to fake, so nobody's farming threads like that yet. That's where I'm putting my energy now.

I don't think a Product Hunt launch solves anything for Taskless, and my guess is it has the same voting networks. HN comments are one of the best signals for whether you've struck a nerve, so "Show HN" is probably where Taskless goes next for the feedback it needs to keep growing.

And thank you to everyone in the Taskless community who showed up. You voted, you asked hard questions, and some of you told your friends. Every one of you was a real person. Except for like, the eight of you I didn't recognize. I checked.