A VPN site has duped journalists into helping it become one of the biggest platforms for VPN reviews on Google.
How do I know? I was one of the journalists fooled.
The site, TheBestVPN.com, claims to offer "honest, in-depth and transparent reviews from real users." However, the site's purported creator does not appear to exist. He goes by the name "John Mason," and his about page initially claimed he received a Masters degree in cybersecurity from a UK university and that he worked at IBM as a security analyst.
But dig around a bit and you'll notice TheBestVPN.com's privacy policy mentions that it's run by a company called "Godmode OU," which is registered as a company in Estonia run by someone named "Robert Mardisalu."
That name, however, wasn't what caught our attention; it was the Facebook and LinkedIn pictures for Mardisalu. They show a man who looks pretty similar to John Mason. And according to Mardisalu's own profile page, he's not a security researcher, but an expert in search engine optimization and digital marketing.
Mardisalu also runs two other Godmode-owned websites called Hostingfacts.com and Websitesetup.org, both of which use fake personas.
For instance, Websitesetup.org claims it was created by a "nomad web developer" named "Robert Mening," who says he was born in Sweden and studied media and marketing at Malmo University, according to an archived web page. But look at the profile pic. The man looks a lot like "John Mason" from TheBestVPN and the Robert Mardisalu social media profiles.
Hostingfacts.com, meanwhile, features a man named "John Stevens," who supposedly runs marketing for the website. However, Stevens' profile photo, once again, bears a strong resemblance to the photos used by John Mason/Robert Mardisalu/Robert Mening. In fact, if you download an archived profile pic for Stevens on Hostingfacts.com, it saves the file as "Robert Mardisalu."
Gaming the System
PCMag was tipped off about the fake identities from a reader, who said he was a former freelancer at a VPN service who became suspicious about the sudden popularity of TheBestVPN.com. Indeed, the review site has only been around for about two years, but in a short amount of time, it's picked up some serious steam in Google's search rankings. Type "VPN reviews" into Google, and TheBestVPN will probably appear as the second search result.
How did the site become so popular? Journalists like me have helped. By using the Mason persona, TheBestVPN promoted its research, which documented problems in certain VPN software. Articles written about that research would then link back to it on TheBestVPN.
These "backlinks" tell Google that a site is an authority on the subject, triggering the search engine to elevate the domain higher in the search rankings. The more times TheBestVPN is quoted, and linked to, the more visibility it can get on Google.
Others in VPN industry have taken note of TheBestVPN's rise. RestorePrivacy, another review site, told PCMag it also uncovered the fake personas used by Mardisalu to promote his websites.
RestorePrivacy pointed out that TheBestVPN also effectively bought backlinks by making donations to technology groups such as The Electronic Frontier Foundation, Let's Encrypt, and The Apache Software Foundation. In return, the groups posted links to TheBestVPN on their sponsorship pages.
Another way TheBestVPN likely rose to the top is its name. Another, unrelated review site called "BestVPN.com" is based in the UK and has been around since 2013. Mardisalu also may have bought the domain TheFreeVPN.com, because it now links to reviews from TheBestVPN.
All this is done to help the site not only attract readers, but also make money. By dominating Google's search rankings, TheBestVPN can generate more revenue through the website's affiliate links. Basically, it will earn a commission fee if you buy a VPN service through the site. (PCMag does the same.)
TheBestVPN acknowledges that it uses affiliate links to earn commissions. "We're real people, on a real mission, trying to make a real difference," the website's about page adds. But when PCMag contacted "John Mason" via his email address and Twitter account asking about discrepancies with his identity, we received no response. Mardisalu did not respond either.
Sometime last fall, TheBestVPN's about page was updated to remove reference to Mason studying cybersecurity and working at IBM. It now says only that Mason is the site's co-founder and lists the sites for which "he" has written. In late-2017, meanwhile, Mason's Twitter profile said he was a "Senior Security Analyst for IBM" based in Japan; it now says he's an an internet privacy and security enthusiast who is "Currently exploiting VPNs."
TheBestVPN's other staff member is a writer named Brad Smith, who authored many of its reviews. However, Smith is also the head of a marketing company called Codeless, which specializes in writing content for websites and lists TheBestVPN and Hostingfacts.com as its clients. Smith also did not respond to a request for comment.
It's unclear if TheBestVPN was honest about its reviews and research. But given the discovery of the fake personas, and Mardisalu's failure to respond to requests for comment, PCMag unpublished three articles from the past year or so that cited Mason and TheBestVPN.
Disclosure: PCMag is owned by j2 Global, a company that also owns many software/service products including Encrypt.me, IPVanish, and StrongVPN.