# Review Manipulation & Developer Misrepresentation — Evidence Report
## Steam Inventory Helper (SIH) v2.11.12–2.12.1 (`cmeakgjggjdlcpncigglobpjbkabhmjl`, RedBoon Limited)

**Method.** All 4,089 written Chrome Web Store reviews (every review ever left, 2014–2026-10-10) were collected via the Apify `automation-lab/chrome-web-store-reviews-scraper` actor + a local Playwright pass with "Lowest to highest rating" sort (765 negative reviews, 286 with developer replies). Contest data: full Telegram channel export (`t.me/sihofficial`, 3,330 posts, user-provided JSON). Skin prices: cs2.sh API (BUFF/Youpin/CSFloat/Skinport/Steam/C5Game asks, 2026-10-11). Code facts: from the webcrack-decompiled build (see `C2-BOTNET-EVIDENCE.md`, `POLICY-VIOLATIONS.md`).

---

# 1. THE SCHEME (PROVEN, END-TO-END)

## 1.1 The instruction to reviewers is verbatim on their own Google Form

Giveaway of 2026-10-08 («PURE DROP», Telegram post #3418, results 2026-10-15). The linked Google Form (forms.gle/QvsjSu7osN8zwCKn9) says, verbatim:

> *"To participate in the giveaway, you also need to **leave any comment about your experience with SIH extension on the Google Web Store page, rate SIH and attach the link to your comment**. Additionally, please provide your Telegram profile for contact. You should follow these steps: 1.) Download SIH from Google WebStore by link … 2.) Leave a comment and copy the link. Link of a comment on Google WebStore (like https://chromewebstore.google.com/reviews/...)"*

Form fields: `Your Telegram profile (@)` + `Link of a comment on Google WebStore`. Prizes: paid onto the winner's **SIH balance**.

This is a **paid-review operation**: rating + comment + proof-of-review-link in exchange for a lottery ticket for skins. It violates Google's policies on **fake and incentivized engagement** (ratings/reviews exchanged for compensation must be disclosed as such; incentivized ratings are removable) and — since the store badge "Featured / 4.5" is marketing currency — constitutes misrepresentation.

## 1.2 The three Google-Form contests (found in the channel export)

| Contest | Announced (Telegram) | Target | Form | Prizes (places 1–3) |
|---|---|---|---|---|
| «PRIME DROP» | 2026-03-31 (#2625) | SIH (extension) | forms.gle/26RhQxXQdbKLYX7AA | AK-47 \| Aphrodite (WW); AWP \| Ice Coaled (MW); M4A4 \| Spider Lily (FT) |
| «SKIN RAID» | 2025-09-25 (#3378) | SIH.Mobile app | forms.gle/Bj4cJoNRoTiwWv3E6 | Zeus x27 \| Dragon Snore (MW); Cmdr. Mae 'Dead Cold' Jamison \| SWAT; Charm \| Baby Karat CT |
| «PURE DROP» | 2026-10-08 (#3418) | SIH Extension | forms.gle/QvsjSu7osN8zwCKn9 | FAMAS \| Afterimage (MW); Patch \| Howl; Galil AR \| Dusk Ruins (MW) |

Beyond these, the channel has run **weekly skin giveaways since 2024-10** with 600–1,200 participants each (self-reported: "Participated 1 198 people", "1 108", "719", "605"…), plus a daily "$5 to sih.app balance" chat activity campaign since April 2025 — a standing incentive machinery pointed at the community that reviews them.

---

# 2. ECONOMICS: THE PRICE OF ONE MOTIVATED 5★ REVIEW

Prices = lowest current ask across BUFF/Youpin/CSFloat/Skinport/Steam/C5Game (cs2.sh, 2026-10-11). "Reviews" = all reviews in the 8-day window after each announcement (attribution per §3).

| Contest | Prize pool (face value) | Attribution | 5★ among them | **Cost per review** |
|---|---|---|---|---|
| PRIME DROP (2026-03-31) | $26.74 ($9.07 + $11.30 + $6.37) | day-of burst: 12 reviews on announcement day (vs 3–5/day baseline); 8-day window: 51 | 50 of 51 (98%) | **$2.23** (day-of burst); $0.52 (full window) |
| SKIN RAID (2025-09-25) | $37.42 ($17.29 + $12.39 + $7.74) | 8-day window: 49, version-clustered on v2.7.x | 45 | **$0.76–0.83** |
| PURE DROP (2026-10-08) | $38.94 ($18.86 + $13.52 + $6.56) | 1 so far (contest live, 74 "Join" at fetch; results 2026-10-15) | 1 | **$0.53** per participant (EV); final per-review pending |

**Working figure: $0.5–2.5 buys one motivated 5-star review** — face value. The real marginal cost is lower: prizes are credited to the **SIH internal balance** (spendable only inside SIH's own ecosystem), so the operation converts store-credit IOUs into Chrome Web Store rating points. Weekly-contest program total: ~3,000 reviews over 69 contest weeks at ~$15–40 pools → **≈ $0.5–0.8/review sustained over 15 months** (full table with post links: `CONTEST-TIMELINE.md`).

**Scale estimate.** Baseline organic 5★ ≈ 15/month (pre-2025). Since 2025-03 the flow is 84–229/month (2025: 1,569 5★; 2026: 693 by October). Excess 5★ ≈ 1,700–2,000 reviews. At $1–2.2 each: **$1,700–4,400 face value to buy the "4.5★ / Featured" badge** — pocket change against the revenue of a 1M-user extension with an ad network, gambling partners and subscriptions.

---

# 3. REVIEW-BURST FORENSICS (ALL 4,089 REVIEWS)

## 3.1 Volume timeline

| Period | Written reviews/month | Character |
|---|---|---|
| 2014-06 → 2025-02 | 5–30 (organic); one 2017-09 spike (314/mo, 369× 1★ that year — historical security scandal wave) | organic |
| **2025-03** | **214 (×10 jump; 181× 5★)** | program start |
| 2025-04 → 2026-05 | 88–244/month, 89–94% are 5★ | sustained inflation |
| 2026-06 → 2026-10 | 36–51/month (contests pivot to SIH.Mobile) | tapering |

Overall histogram: 3,077× 5★ (75%) / 686× 1★ / 79× 2★ / 79× 3★ / 168× 4★.

## 3.2 Burst-days match contest days exactly

- **2026-03-31 (PRIME DROP announced): 12 reviews that day (×3 the daily baseline), all 5★, every single one from extension version 2.9.19** (fresh installers — contest requires "Download SIH"); 51 reviews in the 8-day window, 50 five-star. Texts: "great", "super", "best one", "best extension ever", "super easy to make profit on cs2 with SIH"…
- **2025-09-25 → 10-02 (SKIN RAID): 49 reviews, 45× 5★**, version-clustered on v2.7.0/2.7.1; same week as a 950-participant mega-contest (t.me/sihofficial/2042).
- **2026-10-08 → 10-10 (PURE DROP): first contest review appears 2026-10-10, 5★, v2.12.1** ("Very good app, thank you!" — 2 days after the form opened).
- 2025-03-07/08/10/12…: daily 8–27 reviews — the program ramp-up month.

## 3.3 Template fingerprints

- 1,859 of 3,077 five-star reviews (60%) are under 40 characters.
- Exact duplicate bodies: **"good" ×96, "nice" ×59, "very helpful" ×51, "super" ×51, "very good" ×42**…
- Verbatim duplicate with identical typo across different accounts: *"Insane ammount of essential trading infos. I love it"* (MOONS 2025-09-28; Ioana Andrei 2025-09-07) — a handed-out template, typo included.
- 1-star reviews cluster around real events (2024-06 permissions backlash; 2025-03 ad-injection backlash — 28 negatives that month, the highest since 2017) and are then drowned by the 5★ flow (e.g. 2025-03: 181× 5★ vs 28× 1★).
- Users call it out themselves: *"THE DEVS ARE RUSSIANS AND THEY ARE MANIPULATING REVIEWS WITH BOT ACCOUNTS!"* (2024-11-04); *"scammed reviews and adverts for their casino"* (2025-05-17); *"Don't post your copy pasta about Google"* (2024-06-28).

---

# 4. DEVELOPER REPLIES vs. CODE REALITY (THE MISREPRESENTATION TABLE)

286 reviews carry a reply from **"SIH Tech Support — Developer"**. The replies are heavily copy-pasted (one identical MV3 template was posted 15+ times in June 2024; the "It is very unfortunate to see misleading comments" template repeated verbatim). Each factual claim below is quoted from a real reply (date given), then checked against the decompiled code.

| # | Developer claim (reply, date) | Code reality (decompiled) | Verdict |
|---|---|---|---|
| 1 | *"SIH and all its content undergo regular moderation by Google"* (2026-03-30); *"every version of our extension goes through Google's review process"* (2026-05-28) | Google reviews submitted code, not runtime behavior. Ad content is fetched **live** from `ads.steaminventoryhelper.com/adapi/<token>/find-all` with per-user targeting payload `{f:{…}}` (922.js:84640–84670); DNR header rules are created at **runtime** (shipped `rules.json` = `[]`); 4 C2 event names are obfuscated (`vYPR…`) | **Misleading.** Store review cannot see dynamically served content; "moderated by Google" is used as false assurance for ads the server can swap per user/IP at any moment |
| 2 | *"we have only one affiliate banner… advertising Valve's eSports tournament"* (2025-09-13/22/23, ×9); *"only a single partner banner of a relatively small size at the top of the screen"* (2026-06-15) | Five ad slots (`marketSponsor`, `tradeoffer`, `marketLeftSideBanner`, `externalIntegrationBanner`, `marketSponsorBanner`), four ad sources (`ads.*`, `download.*/banners`, `gainskins.*`, `t.sih-db.com`) + hardcoded **HTTP** banner `http://23.105.226.164/Phx3RR?placement=refillpage` shown only to RU-locale users, injected into Steam's add-funds page | **False.** Multiple banners, multiple networks, gambling partners (CSGOFAST referral `subid2=csgofast`), geo-targeted — exactly the "by-IP on the fly" behavior users describe |
| 3 | *"we have absolutely no connection to anything of that kind"* re: "real money gambling inside" (2025-10-30) | `cases.steaminventoryhelper.com` (case-opening: `openCase`, `sellInventoryItem`, `withdrawalInventoryItem`, `getTopProfit`), CSGOFAST referral in the trade window, gainskins gambling banner feed, Steam balance refill via `foreign.foreignpay.ru` | **False** |
| 4 | *"our extension does not collect authorization access, API keys, or any similar information"* (2025-03-24); *"The extension do not have access to API key so it can't be changed"* (2026-08-31); *"SIH does not have any functionality for collecting authorization data"* (2024-12-24) | Full authentication stack in code: `IAuthenticationService/BeginAuthSessionViaCredentials` (Steam **password** login), `ITwoFactorService/AddAuthenticator` (registers itself as the **Steam Guard** authenticator), maFiles (`shared_secret`/`identity_secret`) in IndexedDB **and uploaded** to `core.sih.app/sih/backups/sync` (922.js:99652–99664), `sessionid`/`steamLoginSecure` cookies read via `chrome.cookies` | **False — the most serious one.** The extension is architecturally capable of exactly what the reviews accuse it of (multiple 2024–2026 reviews report stolen Steam balances and API-key hijacks) |
| 5 | *"SIH does not have the functionality to perform any selling actions without user confirmation"* (2025-03-24) | `auto_confirm_trades`, `market_autoconfirm`, `market_purchase_autoconfirm` settings; `trader_tool.steam.sell_item(s)`, `remove_listing(s)` executable via C2 `task.new`; `tradesend`/`tradeaccept` events; autonomous buy loop with user's balance (922.js:127030–127218) | **False** |
| 6 | *"we do not have access to all sites on the Internet, but only those listed in the permissions"* (2023-11-19); (2020-10-21 reply listed only Steam domains) | Since 2024-06: `host_permissions: ["<all_urls>"]` + `cookies` + `webRequest` + `management` | Was true in 2020–2023; **stale/false for the current build** |
| 7 | *"Starting from June 1, 2024, Google requires all extensions to migrate to the Manifest V3 standards"* (posted 15+ times, June 2024, as the explanation for `<all_urls>`/cookies/management permissions) | MV3 is mandatory — true. **But MV3 does not require** `<all_urls>`, `cookies`, `management` or `webRequest`; those are SIH's own choices (their own 2020 reply confirms narrow-domain operation was possible) | **True fact used to mask a false conclusion** |
| 8 | *"someone has launched an entire anti-advertising campaign against SIH"* (2025-03-18, dismissing the 1★ wave) | The 2025-03 1★ wave (28) coincides with the ad-injection rollout (v2.3.6/2.3.8 complaints: "injecting external ads", "gambling ads"); simultaneously SIH's own incentivized 5★ program starts (181 that month) | **Inversion of reality**: the only documented "campaign" is their own |
| 9 | *"You can check our code and find nothing related to your initial message"* (2020-10-21) | Webpack-obfuscated 4 MB bundle, runtime-created DNR rules, obfuscated C2 event names, remote feature toggles (`sih_app_market_toggle`) | **Practically meaningless** — and remains their standard answer to "spyware" (×13 identical 1★ reviews) and the 171 reviews mentioning scam/spyware/stealing |

**Pattern.** Replies (a) cite Google moderation as a shield for behavior Google cannot observe, (b) minimize ad injection ("one small banner"), (c) deny authorization-data collection that the code demonstrably performs, (d) blame victims ("phishing website or malware… change all your passwords", 2026-08-31), and (e) subtly threaten reviewers ("you bear responsibility for posting comments of this kind that may be considered unlawful", 2026-01-07) — a mild SLAPP flavor aimed at silencing negatives.

---

# 5. GOOGLE POLICY MAPPING

| Policy | Violated? | Evidence |
|---|---|---|
| **Fake engagement / incentivized ratings** (ratings & reviews must be unbiased; compensation for ratings prohibited) | **YES — direct** | §1.1: form requires rating + comment + link submission for giveaway entry; §3.2: burst-days = contest days, same-version clusters; §3.3: template texts |
| **Misrepresentation** (deceiving users about behavior) | **YES** | §4: 9 demonstrably false/misleading developer claims, incl. denial of authorization-secret collection the code performs |
| **Deceptive ads placement** | **YES** | hidden ad slots inside Steam pages incl. HTTP hardcoded-IP banner (RU-only) — while officially claiming "one small reviewed banner" |
| **Spam & placement in the store** | **YES** | 60% of 5★ reviews are <40 chars; single-word duplicates ("good" ×96); "Featured" badge obtained via the above |
| **User Data Privacy (limited use / disclosure)** | **YES** (per prior audit) | maFile cloud sync, userInfo into Sentry, full economic telemetry — none disclosed in the store description |

---

# 6. EVIDENCE INDEX (reproducible)

- Reviews dataset: `%TEMP%\opencode\cws_all.json` (4,089 items, Apify run), `scraper\lowest_fixed.json` (lowest-rating sort, 1,010 parsed), `scraper\dev_replies.json` (286 review+reply pairs)
- Contests: `ChatExport_2026-10-10/result.json` (posts #2625, #3378, #3418; winners posts since 2024-10)
- Google Forms (live at fetch time): QvsjSu7osN8zwCKn9 (PURE DROP, quoted in §1.1), 26RhQxXQdbKLYX7AA (PRIME DROP), Bj4cJoNRoTiwWv3E6 (SKIN RAID)
- Prices: cs2.sh `/v1/prices/latest` (2026-10-11)
- Code refs: `C2-BOTNET-EVIDENCE.md` §2.3–§2.4, §4–§6; webcrack output line numbers as cited

*Date-stamped 2026-10-11. Contest PURE DROP completes 2026-10-15 — a re-scrape after that date is recommended to capture its final review burst (expected +10–35 five-star reviews on v2.12.1, closing the $0.5–3.2/review estimate).*