DERP-1728 — SteemCN

group: DERP-1728
class: Safe
derp_score: 80
special_containment_procedures: |
  Currently contained by downvotes, RC limits, and blacklists.
description: |
  Anomaly DERP-1728 broadcasts high levels of transactions,
  primarily from the on-chain account known as
  "crystalliu."
  
  Examples of anomalous transactions are as follows ...
  
  === Content Edits ===
  
  A majority of DERP-1728's resources credits are consumed
  by edits.  What follows is a sample of the content with
  the highest edit counts, author is crystalliu:
  
  | Permlink           | Edits |
  |--------------------|-------|
  | 0ubftv89alx        |    95 |
  | 1f6d0u549fv        |    94 |
  | 4y2fi265tfk        |   124 |
  | 5opauprbpla        |    89 |
  | 5tydnh-crystal-liu |    94 |
  | 7eweij3a3ix        |   236 |
  | 9qos3tj6gkf        |   101 |
  | bp9vtmtwri2        |   144 |
  | dgz2lczg9yp        |   101 |
  | f3yhx6ikfnx        |    96 |
  | goq36u4juyf        |   119 |
  | h4xhc053p1p        |    88 |
  | nfzpx7feb3a        |   202 |
  | oylkvhxamvx        |   171 |
  | q00s9g             |   118 |
  | q04vu7             |   186 |
  | q06heo             |    89 |
  | vpvvir6wf5o        |   102 |
  | wmb62opntky        |    99 |
  | y4y7wbbov0w        |    92 |

  What is particularly anomalous about the above table is
  that nothing about the content changes in each edit.  The
  same content title, body, metadata is just repeated each
  time.
  
  === Update Proposal Approve ===
  
  The following chart shows how many approval/unapproval
  broadcasts that DERP-1728 makes on a given day.
  
  | Date       | Approve | Count |
  |------------|---------|-------|
  | 2019-11-21 | X       |    67 |
  | 2019-11-21 |         |    58 |
  | 2019-11-22 | X       |    98 |
  | 2019-11-22 |         |   113 |
  | 2019-11-23 | X       |    62 | 
  | 2019-11-23 |         |    47 |
  | 2019-11-24 | X       |    38 |
  | 2019-11-24 |         |    46 |
  | 2019-11-25 | X       |   202 |
  | 2019-11-25 |         |   196 |
  | 2019-11-26 | X       |   138 |
  | 2019-11-26 |         |   147 |
  | 2019-11-27 | X       |   164 |
  | 2019-11-27 |         |   178 |
  | 2019-11-28 | X       |    64 |
  | 2019-11-28 |         |    73 |
  | 2019-11-29 | X       |   375 |
  | 2019-11-29 |         |   364 |
  | 2019-11-30 | X       |   232 |
  | 2019-11-30 |         |   214 |
  
  === Account Witness Votes ===
  
  Similar anomalous behavior, but for witness approval.
  
  | Date       | Approve | Count |
  |------------|---------|-------|
  | 2019-10-15 | X       |   213 |
  | 2019-10-15 |         |   207 |
  | 2019-10-16 | X       |   111 |
  | 2019-10-16 |         |   111 |
  | 2019-10-17 | X       |   201 |
  | 2019-10-17 |         |   201 |
  | 2019-10-18 | X       |   104 |
  | 2019-10-18 |         |   104 |
  | 2019-11-09 | X       |   179 |
  | 2019-11-09 |         |   180 |
associated_accounts:
  - crystalliu
  - liuyifeifansclub
  - crystalliufans
  - dlivetv
  - crystal.liu
  - sistar
  - crystal-liu
  - rubyself
  - crystalliu825
  - steemflagreward
  - gormos
  - botconnect
  - genisys
  - operation
  - botservice
  - authorreward
  - lovecrystalliu
  - chaumet
  - mauser
  - bcctoken
  - bravesoftware
  - communist
  - communistparty
  - crystalliuyifei
  - easonchan
  - eosfinex
  - freemason
  - genesisdtuber
  - greatestdtuber
  - hangseng
  - hangsengbank
  - hongkongpolice
  - huangxiaoming
  - huobitoken
  - i-cable
  - joechen
  - jpx
  - kyber
  - liuximeizi
  - liuyifei
  - loselifesavings
  - luisfonsi
  - lyf
  - mainland
  - memehk
  - mysteemwallet
  - neogas
  - ponzischeme
  - protocollabs
  - ripiocredit
  - sovietunion
  - standardoil
  - steemaddress
  - steemfucker
  - steempowerplant
  - tissot
  - tsuburaya
  - ultramanzero
  - victoryeung
  - violence
  - weirenminfuwu
  - willwarren
  - yangyangicon
  - yifeiliu
  - youtubefucker
  - zeroex
  - zhaowei
related_links:
  - https://github.com/themarkymark-steem/buildawhaleblacklist/commit/3077ef7999313611060dfd13d7c0710450b7a7c0#diff-53c55df0c4ad29ee127fb2e4d0ade6dbR3233
  - https://github.com/themarkymark-steem/buildawhaleblacklist/commit/06bf4bfcbe64b619d4e58073ed17874854f56826#diff-53c55df0c4ad29ee127fb2e4d0ade6dbR18969
  - https://steemit.com/@crystalliu/7eweij3a3ix
  - http://scribe.steemian.info/?url=https%3A%2F%2Fsteemit.com%2F%40crystalliu%2F7eweij3a3ix

Sort Order:

Trending

[-]

test-safari (53) · 5 years ago

Note: DERP-1728 also leverages delete_comment operations extensively to, in part, obfuscate vote farming. In some cases, a comments is created and deleted within the same block. (Or, deleted and then 'undeleted'.) This caused database inconsistency issues in earlier versions of hivemind, and quite possibly other content indexers.

$0.03

5 votes

inertia (73) · 5 years ago

I did not highlight that in the report because lately it hasn't been as bad. Here's the daily delete_comment operations count for all known accounts related to DERP-1728:

Date	Count
2019-11-16	45
2019-11-17	73
2019-11-18	81
2019-11-19	31
2019-11-20	56
2019-11-21	43
2019-11-22	56
2019-11-23	43
2019-11-24	62
2019-11-25	31
2019-11-26	48
2019-11-27	49
2019-11-28	29
2019-11-29	72
2019-11-30	50
2019-12-01	47

Of those deleted since 2017-11-09 01:35:27 UTC, the direct auction author rewards were: 124.105 SBD + 1931.371 STEEM + 4.74 MVESTS

That's actually pretty staggering. And I don't have a way to query what the nested replies of the deleted comments were.

$0.00

2 votes

steem-plus (73) · 5 years ago

Hi, @inertia!

You just got a 0.8% upvote from SteemPlus!
To get higher upvotes, earn more SteemPlus Points (SPP). On your Steemit wallet, check your SPP balance and click on "How to earn SPP?" to find out all the ways to earn.
If you're not using SteemPlus yet, please check our last posts in here to see the many ways in which SteemPlus can improve your Steem experience on Steemit and Busy.