I built a bot that scans dev.to for phishing comments. It found a coordinated campaign. dev.to banned 70+ accounts.

Two weeks ago, a phishing bot commented on my post. Vietnamese text, on-topic, ending with a link to labagent.tech. Click it and you got a fake dev.to login page.

I reported it. Another appeared. Then another. Same pattern, different accounts, all created the same day.

So I built a scanner. The idea came from Harun (@koda2026), who built the original Tiger Sentinel to protect his own posts. I expanded it into a daily scan.

What it does

Scans dev.to's public API. For each article, fetches comments and scores them against two tiers of signals.

Strong (2+ needed to flag as reportable):

• Known phishing domains
• Two or more impersonation phrases ("verify your account", "you have 24 hours")
• Shortlink + Vietnamese text
• Shortlink + near-empty comment
• Shortlink + bot-style username

Weak (review only):

• Single shortlink
• Single impersonation phrase

The two-tier scoring is the whole trick. The first version flagged every comment with a link at the end — 313 findings, most legitimate. Requiring two strong signals dropped the noise to near zero.

What it found

First full scan: 500 articles, 313 flags, 4 confirmed phishing accounts.

• @anh_nguynvn_0478e614ba — 16 comments, labagent.tech
• @shieldxbot — 12 comments, labagent.tech
• @suppdevbot — 8 comments, tr.ee + "official platform update"
• @devantibot — 9 comments, tr.ee + "verify your account"

All four created the same day. All four posting the same pattern. That's a campaign.

The bot groups findings by shortlink domain. That turned 4 accounts into a report:
tr.ee — 2 accounts (phishing)
labagent.tech — 2 accounts (phishing)
tinyurl.com — 25 accounts (coordinated?)
shorturl.at — 23 accounts (coordinated?)
t.co — 20 accounts (likely legitimate)

text

How I reported it

dev.to has a report abuse form at /report-abuse that accepts bulk reports. I sent one submission:

• The 4 confirmed phishing accounts
• The 3 domain clusters

Not 199 individual reports. One form, five groups.

What happened

A few days later, all four accounts were gone. dev.to banned them. The tr.ee cluster dropped from 5 to 3. labagent.tech disappeared.

Two weeks later, my account was flagged as Trusted User. The system recognized that my report got a real campaign removed. Future reports now go to the front of the moderation queue.

That's the whole pipeline: Harun's idea → my expanded scan → report → platform acts → trust built.

The lessons

The first version was wrong. 313 flags, mostly legitimate comments. The fix wasn't removing weak signals — it was requiring strong ones to co-occur.

The scanner is not a judge. It produces candidates. A human decides. The 313 → 4 funnel is the point. If a bot reports everything, it reports nothing.

Bulk beats individual. A moderation team processes "4 accounts using the same phishing domain" faster than 199 separate flags.

Continuous beats one-time. Three scans in a row found zero new reportable accounts. That's the success case — no new campaign appeared after the first was removed.

The code

The core scoring function:

python
def score_comment(text, username):
    strong, weak = [], []

    for domain in PHISHING_DOMAINS:
        if domain in text.lower():
            strong.append(f"phishing-domain:{domain}")

    hits = [p for p in IMPERSONATION_PHRASES if p in text.lower()]
    if len(hits) >= 2:
        strong.append("impersonation-pair")
    elif len(hits) == 1:
        weak.append(f"imp-phrase:{hits[0]}")

    short = next((d for d in SHORTLINKS if d in text.lower()), None)
    if short:
        if VIETNAMESE_REGEX.search(text):
            strong.append(f"shortlink+vn:{short}")
        elif len(text) < 20:
            strong.append(f"shortlink+near-empty:{short}")
        else:
            weak.append(f"shortlink:{short}")

    if len(strong) >= 2:
        return "report"
    elif strong or weak:
        return "review"
    return None
That's the whole logic. The rest is pagination, rate limiting, and output formatting.

The takeaway
dev.to is mostly safe. The spam you see is a small number of accounts posting a lot. A coordinated campaign of 4 accounts produced 45 comments across the platform — enough to feel like a flood if you're one of the people getting them, but tiny against the total comment volume.

The report form works. Bulk reporting works. Trusted User status is real and earned by making reports that get acted on.

The scanner is Python on GitHub Actions. I wrote it by describing what I wanted to Google AI Studio and fixing what broke. Not production-grade — no tests, no retries, no alerting. But it caught a real campaign and got it removed.

Credit to Harun (@koda2026) for the original Tiger Sentinel concept. He built it to protect his posts. I turned it into a daily scan.

forkcount.github.io is the calorie tracker I built the same way.

The report abuse form at dev.to is /report-abuse. Bulk submission made the difference.