is it legit?

← all places

Ulu Ulu Spa Gaya Street

checked Jun 2026
Lot 80, 1st Floor, Gaya Street (Above Keng Wan Hing, Pusat Bandar Kota Kinabalu, 88000 Kota Kinabalu, Sabah, Malaysia

google maps ↗

D69/100

manipulation detected

4.86★405 reviews

At least 16 reviews were posted by low-history accounts in a single day with statistically unlikely review volume: August 13, 2025 received 19 reviews (about 1 in 1015 by chance based on normal volume). This looks like a coordinated 5 star campaign by the business.

base score
every place starts at 100
100
rating inflation
headline 4.86★ is 0.02 above the 4.84★ that credible reviewers (detailed Local Guides) give
-1
coordinated review injection
19 reviews landed on 2025-08-13 (about 1 in 1015 by chance); 16 of them (3.95% of all reviews) came from low-history, non-Local-Guide accounts
-9
verdict cap
a manipulation conviction caps the grade at a D (at most 69)
-21
final trust score69 / 100
reviews analyzed405
headline rating4.86★
credible reviewers50 · 4.84★
established accts (30+)14 · 4.64★
inflation gap+0.02
local guides (all)63 · 4.86★
single-review accts31%
flagged reviews16 (3.95%)
worst spike19 · 1 in 1015
review bombingnone
burstiness1.91 (organic≈1)
velocity1.3/day on 54% of days
cross-posted reviews0 (0%)

how it works

Step 1: your agent collects the reviews

It opens the listing in its own browser, sorts by newest and collects them: all of them, or the 500 most recent at a big listing. We don't scrape Google.

Step 2: we run the stats

Burst days, throwaway accounts, cross-posted text, solicited reviews, rating drift. Statistics, not vibes.

Step 3: you get a grade

A to F, plus the rating credible reviewers actually give, with the evidence one click away. The place then appears here for everyone.

Google usually asks the browser to be signed in before it will sort or load more reviews. The agent reads Maps through your signed-in browser, much like scrolling the listing yourself. Heavy use could trip Google's rate limits; if you plan to check many places, a secondary Google account is a sensible choice.

No agent? Scripts can POST the same review JSON to /api/submissions; the format is at /api/sources/google-maps. Everything required is visible on the review card; review ids and exact timestamps are optional. Results from a single unconfirmed submitter are labeled as such until a second source agrees.

methodology

what signals do we look for?

We read a place's full review history and weigh the signals that are costly for a review farm to fake:

  • Burst campaigns: clusters of 5 star reviews dumped on a single day by low-history accounts. A genuine surge keeps a place's normal share of Local Guides, so it isn't counted against it.
  • Drip-feed farms: reviews arriving nearly every day at a pace no organic business sustains, a paid stream spread thin to dodge obvious spikes.
  • Cross-posted text: the same review copied word-for-word onto other businesses, a farm seeding a whole chain.
  • Throwaway accounts: single-review profiles padding the average up.
  • Review solicitation: reviewers themselves reporting that the business rewards, pressures, or steers reviews (“free dessert if you leave 5 stars”). An LLM reads every such mention; only firsthand reports of policy-violating practices count, and the penalty deepens with each independent witness. Politely asking for a review is allowed by Google and never counted.
  • Too-perfect records: a spotless, unanimous 5 star history often signals curated or incentivized reviews, so it can't earn a top grade, even when we can't prove fraud.
what's the “adjusted rating”?

What hard-to-fake reviewers actually give, vs the headline number. A gap means the rating is inflated. Two groups qualify:

  • Credible reviewers are Local Guides who also wrote a substantive review. The badge alone is gameable (farms run Local Guide accounts that drop bare 5 star ratings), so we only count ones that put real words behind the stars.
  • Established accounts have 30+ lifetime reviews, regardless of badge or text. Farms pad accounts with a handful of reviews to look plausible, but aging thousands of accounts past 30 is the expensive part.

Each place is anchored to whichever group gives the more conservative rating. When a place corrects the headline number, the “per credible reviewers” / “per established accounts” label tells you which.

where does the review data come from?

From the agents and scripts that submit it. Every submission is checked for structure and consistency (Google's own review and profile ids, timestamps against displayed dates, the rating average against the displayed rating, the count against the listed count, overlap with what we already hold), and a place submitted by one unconfirmed source carries an unverified source note until a second, independent submission agrees. Places we pulled ourselves before October 2026 need no such note.

what does a high score mean?

It means we found no evidence the business is manipulating or inflating its own reviews. It does not promise the rating is accurate: a clean place can still be mis-rated by too few reviews, reviewers who self-select, or honest reviews that just don't match your experience. We measure whether the number looks gamed, not whether it's right.