I built a bot that scans dev.to for phishing comments. It found a coordinated campaign. dev.to banned 70+ accounts.
Two weeks ago, a phishing bot commented on my post. Vietnamese text, on-topic, ending with a link to labagent.tech. Click it and you got a fake dev.to login page. I reported it. Another appeared. Then another. Same pattern, different accounts, all created the same day. So I built a scanner. The idea came from Harun (@koda2026), who built the original Tiger Sentinel to protect his own posts. I expanded it into a daily scan. Scans dev.to's public API. For each article, fetches comments and scores
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.