The prosperity of online rating system makes it a popular place for malicious vendors to mislead public's online decisions, whereas the security related studies are lagging behind. In this paper, we develop a quantile regression model to investigate influential factors on online user choices and reveal that the promotion effect on products' market outcomes is determined by not only the attacker's manipulation power but also the specific property of the target product and the market self-exciting power. Inspired by these findings, we propose a novel iterative rating attack and validate its effectiveness through experiments.