Piotr Zarzycki - I'm Still a Dietitian: Fake Reviews, Fake Experts, and the Real Internet
Analysts investigate attack surfaces and defenses concerning Piotr Zarzycki - I'm Still a Dietitian: Fake Reviews, Fake Experts, and the Real Internet.
Summary
### Overview In this presentation, Piotr Zarzycki delivers a follow-up to his 2023 talk on fake online reviews, social proof manipulation, and platform moderation. Zarzycki begins by demonstrating how easily industry vanity credentials can be manufactured, detailing how he acquired an international "40 under 40 in cybersecurity" award and magazine cover feature with minimal effort and no technical vetting. He then transitions to a large-scale investigative analysis of the Polish medical booking platform ZnanyLekarz, examining how fake and copied reviews persist despite regulatory penalties and platform moderation promises.
### Key Topics - **Manufactured Industry Accolades**: Zarzycki shares how discovering a "40 under 40 in cybersecurity" listing led him to contact the publisher (*Top Cyber News Magazine*). By submitting an article and a photograph, he secured a spot on the magazine cover and an official "Top International Forty Under Forty" certificate without undergoing a rigorous evaluation. - **The Fake Review Economy**: Highlighting U.S. and Polish (UOKiK) studies showing that over 90% of consumers rely on and trust internet reviews, Zarzycki reviews the commercial black market for reviews. Despite UOKiK fining review-selling entities like Opinie.pro, these services continue to operate. Similar services advertise via Google Ads or coordinate cheaply on Discord, where reviews are purchased for as little as 2–4 PLN via BLIK. - **ZnanyLekarz Evolution & Scrutiny**: Comparing data from 2023 to the present, Zarzycki notes ZnanyLekarz grew to 300,000 doctors and 25 million appointments, while backing down from claiming "100% verified reviews" to stating that opinions are moderated according to internal rules. - **Becoming a Verified Specialist**: To test onboarding verification, Zarzycki legitimately completed three online courses from the Polish Institute of Dietetics (Polski Instytut Dietetyki) over a few days for 2,400 PLN, received official diplomas, and successfully set up a verified dietitian profile on ZnanyLekarz.
### Technical Details - **Scraping Methodology**: To gather platform-wide data, Zarzycki inspected ZnanyLekarz's XML sitemaps (`sitemap_doctor.xml`, etc.), uncovering 110,407 unique doctor profile URLs after deduplication. To capture profiles missing from the sitemaps, he systematically mapped specialization and city index pages with pagination. - **Overcoming Protections**: Scraping additional review pages required replaying the asynchronous JavaScript requests triggered by the "see more" button. When rate limiting, CAPTCHAs, and Cloudflare challenges halted simple requests, Zarzycki distributed the load using virtual machines running commercial VPNs, rotating IP addresses whenever CAPTCHA thresholds were reached. - **Dataset Statistics**: The final scrape yielded 138,000 profiles, over 4 million reviews across 97,000 reviewed doctors, and nearly 4 GB of raw text spanning from 2007 to May 23. - **Exact & Fuzzy Duplicate Analysis**: Exact-string matching identified identical reviews spanning up to 190 profiles (such as identical paragraphs applied interchangeably to urologists and gynecologists). For near-duplicates, Zarzycki implemented a normalization pipeline: lowercasing, stripping Polish diacritics, unifying titles (e.g., all to "doktor"), standardizing gender references, replacing numbers with placeholders, collapsing whitespace and repeated characters, stripping emojis, and filtering reviews under five words. The normalized text was tokenized, candidate pairs were filtered based on shared tokens and length constraints (within 10 words, max 300 candidates per review), and text similarity was evaluated. - **ZnanyŚciemniacz**: Zarzycki published a public tool, `znanyściemniacz.pl`, enabling users to input a doctor's profile URL to detect matching or near-duplicate reviews across the platform.
### Takeaways While ZnanyLekarz reported detecting 1,000 to 2,000 suspicious reviews monthly using 24 risk factors and flagged potential account suspensions, Zarzycki found that identical copy-pasted reviews highlighted during his 2023 presentation remained live years later—including identical reviews duplicated on the exact same doctor profile. Paradoxically, the platform promptly wiped the reviews written on Zarzycki's own profile ahead of the talk. Zarzycki closes by highlighting the persistent vulnerability of crowd-sourced rating ecosystems and the need for independent scrutiny.
Related talks
PROIDEA Events·43 min
Piotr Zarzycki · Paweł Srokosz
Security researchers examine technical aspects of Piotr Zarzycki, Paweł Srokosz: ScamBook | OMH 2024.
PROIDEA Events·34 min
Piotr Zarzycki
Engineers explore architecture and security mechanisms for Piotr Zarzycki: ZnanySciemniacz.pl czyli jak zostałem dietetykiem i przeanalizowałem 3m komentarzy.
PROIDEA Events·39 min
Security researchers examine technical aspects of Piotr Zarzycki, Michał Łopacki - Proxy dla przestępców na Twoim urządzeniu [OMH 2022].


