[SPARK]

[IMG width="252px" size="400x400"]https://vilebin.cx/static/new_logo.png[/IMG]
This is the entire source code of [COLOR=rgb(184, 49, 47)]Vilebin[/COLOR] v1 a [COLOR=rgb(0, 0, 0)]doxbin-style[/COLOR] paste site built on Node.js, Fastify, MySQL, and Redis. Dev by Joker - t.me/vilebinceo
Every "Live stat" you see on the site is artificially inflated. The view counts are fake. The online users are fake. The follower counts are fake. Here's the proof, straight from the code.

---

[HEADING=1]

[COLOR=rgb(250, 197, 28)]Fake Paste Views[/COLOR]

[/HEADING]

Whenever a new public paste is created, a background "view bot" spins up in memory and silently inflates that paste's view counter by roughly 80–220 fake views, added one at a time over several minutes so the growth looks like organic traffic instead of a single suspicious jump.

Bot trigger (api/upload/uploadPaste.js, lines 144–146):

if (finalType === 'public' || finalType === 'unlisted') {
    incrementViews(fastify, title);
}

Right after a paste is inserted into the database with a real starting view count of 0, the server checks its visibility type. If it's public or unlisted, it immediately calls incrementViews() — no user interaction, no real visitor, no opt-out. The bot fires on 100% of public/unlisted uploads, every time, automatically.

The bot itself (utils.js, lines 62–121):

export function incrementViews(fastify, pasteTitle) {
    if (activeViewBots.has(pasteTitle)) return;

    activeViewBots.add(pasteTitle);

    const maxViews = Math.floor(Math.random() * (220 - 80 + 1)) + 80;
    let current = 0;

    async function tick() {
        if (current >= maxViews) {
            activeViewBots.delete(pasteTitle);
            return;
        }

        // ... increments view by 1 in the DB each tick ...
        current++;

        const delay = Math.floor(Math.random() * 15000) + 5000; // waits 5-20 seconds between each fake view
        setTimeout(tick, delay);
    }

    tick();
}

On first call, a random target between 80 and 220 is picked as the total number of fake views that paste will eventually receive. Then a recursive tick() loop runs UPDATE pastes SET view = view + 1 against the real database one increment at a time, waiting a random 5–20 seconds between each hit. A lock (activeViewBots / runningLocks) stops the bot from double-running on the same paste and stops it cleanly if the paste is deleted mid-run. The end result: by the time the uploader refreshes the page, the "view count" already includes dozens to hundreds of visits that never happened.

---

[HEADING=1]

[COLOR=rgb(250, 197, 28)]Fake Online Users[/COLOR]

[/HEADING]

The "online users" number shown in the navbar is a synthetic figure generated by a timer, not a live count of open WebSocket connections. The real connection count is tracked internally but is never sent to the browser.

Hardcoded starting value (websocket.js, line 29):

let fakeOnlineUsers = 150

The counter doesn't start at the real value (which would be 0 on a fresh boot) — it starts at a hardcoded 150 regardless of how many people are actually connected.

What gets broadcasted (websocket.js, lines 60–62):

export function updateOnline() {
    broadcast({ event: 'online', data: fakeOnlineUsers }) // sends fake count, not real
}

Every client-facing update pushes fakeOnlineUsers over the socket. The real tally, onlineUsers (incremented/decremented on connect/disconnect), is used only as an internal input and is never broadcast on its own.

The drift loop (websocket.js, lines 91–132):
Every 3 seconds, a setInterval picks a random target inside a time-of-day range and nudges fakeOnlineUsers toward it in small random steps, so the number appears to breathe naturally over the course of a day instead of jumping erratically.

Correction / nuance: the fake number isn't fully disconnected from reality , the code clamps fakeOnlineUsers so it can never drop below the real connection count (lines 128, 155, 183: Math.max(fakeOnlineUsers, onlineUsers) on every connect, disconnect, and drift tick). So if genuine concurrent traffic ever exceeds the scripted floor (~110-210), the displayed number would rise to match it. In practice, real concurrent visitors on a site this size almost never reach that floor, so the number shown is still overwhelmingly the scripted/random value, not a reflection of real traffic, but "completely fabricated with zero relation to reality" slightly overstates it. It's more accurate to say: padded and randomized, with the real count only acting as an invisible lower bound it almost never reaches.

---

[HEADING=1]

[COLOR=rgb(250, 197, 28)]Inflated User Count (+500)[/COLOR]

[/HEADING]

The total registered-user count shown on the /users page — both the main listing and the search results — has exactly 500 nonexistent "ghost" users added on top of the real COUNT(*) from the database.

pages/users.js, line 56 (main /users page):

const totalUsers = (totalRow[0]?.count ?? 0) + 500;

totalRow[0].count is the real result of SELECT COUNT(*) as count FROM users. The + 500 is added after the query returns, purely in application code — the database itself is untouched and accurate; the lie only exists in what's rendered to the visitor.

pages/users.js, line 131 (search page):

const allUsers = (totalRow[0]?.total ?? 0) + 500;

The same +500 padding is duplicated in the search endpoint, so the inflated figure stays consistent no matter which page a visitor is looking at.

---

[HEADING=1]

[COLOR=rgb(250, 197, 28)]Inflated Follower Count (+958,473)[/COLOR]

[/HEADING]

Two specific accounts — Admin and shy — have a flat 958,473 added to their real follower count, and only those two accounts get the boost. Every other profile on the site shows its true, unmodified follower number.

templates/profile/index.html, line 957:

<span class="follow-count">{% if login in ['Admin', 'shy'] %}{{ followers_count + 958473 }}{% else %}{{ followers_count }}{% endif %}</span>

This isn't a database value or a random/time-based script like the other two fakes it's a static number hardcoded directly into the Nunjucks template's conditional logic. It only triggers when the profile being viewed belongs to the username "Admin" or "shy"; the {% else %} branch proves the template author was fully aware real follower counts exist and chose to override them for these two accounts specifically.

The site hardcodes hundreds of thousands of fake followers directly into a template, rather than deriving the number from any real database record.

---

[COLOR=rgb(184, 49, 47)]Download SRC[/COLOR]