group: DERP-1728
class: Safe
derp_score: 80
special_containment_procedures: |
Currently contained by downvotes, RC limits, and blacklists.
description: |
Anomaly DERP-1728 broadcasts high levels of transactions,
primarily from the on-chain account known as
"crystalliu."
Examples of anomalous transactions are as follows ...
=== Content Edits ===
A majority of DERP-1728's resources credits are consumed
by edits. What follows is a sample of the content with
the highest edit counts, author is crystalliu:
| Permlink | Edits |
|--------------------|-------|
| 0ubftv89alx | 95 |
| 1f6d0u549fv | 94 |
| 4y2fi265tfk | 124 |
| 5opauprbpla | 89 |
| 5tydnh-crystal-liu | 94 |
| 7eweij3a3ix | 236 |
| 9qos3tj6gkf | 101 |
| bp9vtmtwri2 | 144 |
| dgz2lczg9yp | 101 |
| f3yhx6ikfnx | 96 |
| goq36u4juyf | 119 |
| h4xhc053p1p | 88 |
| nfzpx7feb3a | 202 |
| oylkvhxamvx | 171 |
| q00s9g | 118 |
| q04vu7 | 186 |
| q06heo | 89 |
| vpvvir6wf5o | 102 |
| wmb62opntky | 99 |
| y4y7wbbov0w | 92 |
What is particularly anomalous about the above table is
that nothing about the content changes in each edit. The
same content title, body, metadata is just repeated each
time.
=== Update Proposal Approve ===
The following chart shows how many approval/unapproval
broadcasts that DERP-1728 makes on a given day.
| Date | Approve | Count |
|------------|---------|-------|
| 2019-11-21 | X | 67 |
| 2019-11-21 | | 58 |
| 2019-11-22 | X | 98 |
| 2019-11-22 | | 113 |
| 2019-11-23 | X | 62 |
| 2019-11-23 | | 47 |
| 2019-11-24 | X | 38 |
| 2019-11-24 | | 46 |
| 2019-11-25 | X | 202 |
| 2019-11-25 | | 196 |
| 2019-11-26 | X | 138 |
| 2019-11-26 | | 147 |
| 2019-11-27 | X | 164 |
| 2019-11-27 | | 178 |
| 2019-11-28 | X | 64 |
| 2019-11-28 | | 73 |
| 2019-11-29 | X | 375 |
| 2019-11-29 | | 364 |
| 2019-11-30 | X | 232 |
| 2019-11-30 | | 214 |
=== Account Witness Votes ===
Similar anomalous behavior, but for witness approval.
| Date | Approve | Count |
|------------|---------|-------|
| 2019-10-15 | X | 213 |
| 2019-10-15 | | 207 |
| 2019-10-16 | X | 111 |
| 2019-10-16 | | 111 |
| 2019-10-17 | X | 201 |
| 2019-10-17 | | 201 |
| 2019-10-18 | X | 104 |
| 2019-10-18 | | 104 |
| 2019-11-09 | X | 179 |
| 2019-11-09 | | 180 |
associated_accounts:
- crystalliu
- liuyifeifansclub
- crystalliufans
- dlivetv
- crystal.liu
- sistar
- crystal-liu
- rubyself
- crystalliu825
- steemflagreward
- gormos
- botconnect
- genisys
- operation
- botservice
- authorreward
- lovecrystalliu
- chaumet
- mauser
- bcctoken
- bravesoftware
- communist
- communistparty
- crystalliuyifei
- easonchan
- eosfinex
- freemason
- genesisdtuber
- greatestdtuber
- hangseng
- hangsengbank
- hongkongpolice
- huangxiaoming
- huobitoken
- i-cable
- joechen
- jpx
- kyber
- liuximeizi
- liuyifei
- loselifesavings
- luisfonsi
- lyf
- mainland
- memehk
- mysteemwallet
- neogas
- ponzischeme
- protocollabs
- ripiocredit
- sovietunion
- standardoil
- steemaddress
- steemfucker
- steempowerplant
- tissot
- tsuburaya
- ultramanzero
- victoryeung
- violence
- weirenminfuwu
- willwarren
- yangyangicon
- yifeiliu
- youtubefucker
- zeroex
- zhaowei
related_links:
- https://github.com/themarkymark-steem/buildawhaleblacklist/commit/3077ef7999313611060dfd13d7c0710450b7a7c0#diff-53c55df0c4ad29ee127fb2e4d0ade6dbR3233
- https://github.com/themarkymark-steem/buildawhaleblacklist/commit/06bf4bfcbe64b619d4e58073ed17874854f56826#diff-53c55df0c4ad29ee127fb2e4d0ade6dbR18969
- https://steemit.com/@crystalliu/7eweij3a3ix
- http://scribe.steemian.info/?url=https%3A%2F%2Fsteemit.com%2F%40crystalliu%2F7eweij3a3ix
Note:
DERP-1728
also leveragesdelete_comment
operations extensively to, in part, obfuscate vote farming. In some cases, a comments is created and deleted within the same block. (Or, deleted and then 'undeleted'.) This caused database inconsistency issues in earlier versions ofhivemind
, and quite possibly other content indexers.I did not highlight that in the report because lately it hasn't been as bad. Here's the daily
delete_comment
operations count for all known accounts related toDERP-1728
:Of those deleted since
2017-11-09 01:35:27 UTC
, the direct auction author rewards were:124.105 SBD
+1931.371 STEEM
+4.74 MVESTS
That's actually pretty staggering. And I don't have a way to query what the nested replies of the deleted comments were.