Two weeks ago, every post I read had the same comment underneath it. Vietnamese text, on-topic, ending with a link to labagent.tech. Click it and you got a fake dev.to login page asking for your credentials.
That's phishing. Not spam, not self-promotion — a fake login page designed to steal accounts.
Today, there's none. I checked. The scanner I run every night came back with zero reportable findings for the third day in a row. No labagent.tech, no tr.ee impersonation accounts, no phishing campaign against dev.to users.
Here's what happened.
What is Tiger Sentinel
Tiger Sentinel is a Python script that scans dev.to's public API for coordinated spam and phishing comments.
The concept came from Harun (@koda2026), a 12-year-old developer who built the original version to protect his own posts. I expanded it into a full daily scan that covers thousands of articles per run.
The name comes from Harun. The expansion is mine. The bot runs on GitHub Actions at 3 AM UTC every day.
What it does
For each article on dev.to, it fetches the comment thread and scores every comment against two tiers of signals.
Strong signals — two or more means "report this":
- Known phishing domains (
labagent.tech,suppdev.io) - Two or more impersonation phrases ("official platform update", "verify your account", "you have 24 hours")
- Shortlink domain + Vietnamese text
- Shortlink domain + near-empty comment
- Shortlink domain + bot-style username (
name_name_hexid)
Weak signals — flags for review, not report:
- Single shortlink
- Single impersonation phrase
- Boilerplate phrases
A comment needs two strong signals to be classified as reportable. One strong signal plus weak signals lands in the review queue. Zero strong signals means ignore.
That's the whole design. The first version flagged every comment with a link at the end — 313 findings, most of them legitimate. The rewrite requiring two strong signals dropped the noise to near zero.
What it found
First full scan: 500 articles, 313 flags, 4 confirmed phishing accounts.
-
@anh_nguynvn_0478e614ba— 16 comments,labagent.tech -
@shieldxbot— 12 comments,labagent.tech -
@suppdevbot— 8 comments,tr.ee+ "official platform update" -
@devantibot— 9 comments,tr.ee+ "verify your account"
All four created on the same day. All four posting the same pattern. That's not four spammers who found the same domain. That's a coordinated phishing campaign.
The bot also groups findings by shortlink domain, which turned 4 accounts into a larger picture:
tr.ee — 2 accounts (phishing)
labagent.tech — 2 accounts (phishing)
tinyurl.com — 25 accounts (coordinated?)
shorturl.at — 23 accounts (coordinated?)
t.co — 20 accounts (likely legitimate)
text
The tr.ee and labagent.tech pairs were the actual phishing campaign. The rest were pattern matches that needed human judgment.
How it got reported
dev.to has a report abuse form at /report-abuse that accepts bulk reports. I sent one submission:
- The 4 confirmed phishing accounts
- The 3 domain clusters
- A note explaining which were confirmed phishing and which were pattern matches
Not 199 individual reports. One form, five groups. That's the difference between a report a moderation team can act on and a report that gets filed as noise.
What happened
A few days later, all four phishing accounts were gone. dev.to banned them. The tr.ee cluster dropped from 5 accounts to 3. labagent.tech disappeared entirely.
Two weeks later, my account was flagged as Trusted User. The system recognized that my report got a real phishing campaign removed. Trusted User status means future reports go to the front of the moderation queue.
What the scanner looks like now
Three full scans in a row have found zero reportable findings. The bot runs for five hours, covers roughly 5,000 articles per run, and comes back with nothing.
That's the success case. Not "the bot found more phishing." The bot finding nothing means the phishing campaign is gone and no new one has appeared.
The review findings — 900 to 1,000 per scan — are legitimate comments with shortlinks. People sharing tweets, blog posts, YouTube videos. Not phishing.
The cluster counts still fluctuate: t.co has 137 accounts, shorturl.at has 45. Those are likely legitimate. Twitter links and URL shorteners used by real users.
The lessons
The first version was wrong. 313 flags, mostly legitimate comments. The fix wasn't removing weak signals — it was requiring strong ones to co-occur.
The scanner is not a judge. It produces candidates. A human decides. The 313 → 4 funnel is the point. If a bot reports everything, it reports nothing.
Bulk beats individual. A moderation team processes "4 accounts using the same phishing domain" faster than 199 separate flags.
Continuous beats one-time. Daily scanning means the next phishing campaign gets caught on day one, not week three.
What's next
The bot runs every night. If a new phishing campaign appears, findings_report.json will have it in the morning. If a new cluster forms with a known phishing domain, the report goes to dev.to within a day.
The concept came from Harun. The daily scan is mine. The result is a platform with no active phishing campaign against it.
That's a real win. Not "I built a tool" — "I built a tool, used it, and the phishing campaign it was built to fix is gone."
The scanner is Python on GitHub Actions. I wrote it by describing what I wanted to Google AI Studio and fixing what broke. It's not production-grade — no tests, no retries on transient failures, no alerting. But it caught a real phishing campaign and got it removed.
Credit to Harun (@koda2026) for the original Tiger Sentinel concept. He built it to protect his own posts. I turned it into a daily scan.
The report abuse form at dev.to is /report-abuse. Bulk submission made the difference.
Top comments (0)