I keep seeing agencies and AI startups claiming they can get brands “visible on Reddit.”
Are they doing SEO, community marketing, influencer outreach, organic participation, paid ads, or something else?
I’d love to hear from people who’ve actually done this. What’s legitimate, and what’s mostly marketing?
Please send me your resume at vivek@talkdrill.com
Also will Appreciate your feedback and direction on this product
Was going through session ratings on TalkDrill, the AI English speaking app I am building, and noticed something odd.
One user rated their AI session 3 out of 5 stars. The comment right next to it says the session was very useful and that they learned new words.
This is not a one off. I keep seeing ratings and comments that do not match up.
My current theory is that some users are not rating the experience itself. They might be rating something else entirely, like how hard the session felt, or just have a personal habit of never giving full marks even when they are happy.
Has anyone else building a product with star ratings run into this. Curious how you handle it, or if you have found a way to get cleaner signal from users.
Yes, You should take Debt in your 20s but amount should be too low. This will help you improve your credit score. Like my EMI is 17000 per month which is less than 10% of my monthly income, but I see in CIBIL it is improving my score and my account credit age. What do you think on this?
So this landed 2 minutes ago:
42 se 72. Almost 70% upside. Even told me the exact quantity to buy — 2900. Kitna caring of them 🥹
If hard work is the key to success, why are millions of hardworking people still struggling financially?
we run TalkDrill, an app with phone OTP verification at signup. We had spent months making sure our infrastructure could survive the obvious attacks. DDoS, someone trying to take the site down, that whole category. We genuinely felt ready.
This was nothing like that. It never tried to take us down. It abused our OTP flow, which was working exactly as designed. Every fake OTP request triggered a real SMS, and every SMS costs money. So we were quietly bleeding cash while every dashboard looked perfectly healthy.
The confusing part is that at first it looked like good news. Our SMS balance was dropping fast, and our first thought was that we were finally getting real users from outside India.
Then we actually looked at the funnel. These users were requesting an OTP and then never completing onboarding. Real users who ask for a code almost always continue. These did not. We layered in Microsoft Clarity session data and it became obvious. These were not people exploring the app. They were hitting the OTP step over and over and leaving.
Turns out this has a name: SMS pumping, also called IRSF, or International Revenue Share Fraud. The way it works is that in some countries, shady mobile operators get a commission for every SMS that lands on their numbers. Fraudsters, and sometimes regular people paid small amounts, feed phone numbers into any app with an OTP flow purely to trigger the send. They do not care about logging in. They just want the message to go out. Their revenue, your bill. Some of the traffic was even real humans, which is why it was so hard to spot at first.
We thought we could fix it quickly. We could not. Every obvious fix has a hole in it:
Block their IP and they switch through a VPN in seconds. Geo block a country and they route through a VPN exit in a country you allow, and some of your real users are on VPNs anyway. Block the phone country code and they move to a new one you have not blocked. Just rate limit and they spread across thousands of IPs, each one staying under your limit.
Here is the part I keep thinking about. My team suggested the simplest possible fix: block every country except India and move on. It would have killed the attack instantly. But we were genuinely getting real, paying users from outside India, and that option would have thrown them out along with the bots. I decided against it. I was not willing to lose real customers just to win against attackers, even though it was clearly the easier path.
So instead we built a layered system. Blocking by where the IP actually originates. A blocklist of high fraud country codes that have no real users for us. Blocking entire datacenter IP ranges instead of single addresses, since the bots cluster inside them. Behavioral detection that automatically bans patterns no real person produces, like three OTP requests within 120 seconds, or a stream of requests where nobody ever enters the code. An India first lockdown that triggers automatically when it senses a spike and quietly routes everyone else to email sign in instead of locking them out. And a hard daily SMS budget, so the loss can never go past a number we set in advance.
The biggest takeaway for me: a sudden spike in signups that never convert is not growth, it is a warning sign. Watch your funnel, not just the top line number.
Curious if anyone else here has dealt with SMS pumping or IRSF. How did you handle it? And honestly, would you have just gone India only, or made the same call we did?
