DERP-1728

[inertia]

group: DERP-1728
class: Safe
derp_score: 80
special_containment_procedures: |
  Currently contained by downvotes, RC limits, and blacklists.
description: |
  Anomaly DERP-1728 broadcasts high levels of transactions,
  primarily from the on-chain account known as
  "crystalliu."
  
  Examples of anomalous transactions are as follows ...
  
  === Content Edits ===
  
  A majority of DERP-1728's resources credits are consumed
  by edits.  What follows is a sample of the content with
  the highest edit counts, author is crystalliu:
  
  | Permlink           | Edits |
  |--------------------|-------|
  | 0ubftv89alx        |    95 |
  | 1f6d0u549fv        |    94 |
  | 4y2fi265tfk        |   124 |
  | 5opauprbpla        |    89 |
  | 5tydnh-crystal-liu |    94 |
  | 7eweij3a3ix        |   236 |
  | 9qos3tj6gkf        |   101 |
  | bp9vtmtwri2        |   144 |
  | dgz2lczg9yp        |   101 |
  | f3yhx6ikfnx        |    96 |
  | goq36u4juyf        |   119 |
  | h4xhc053p1p        |    88 |
  | nfzpx7feb3a        |   202 |
  | oylkvhxamvx        |   171 |
  | q00s9g             |   118 |
  | q04vu7             |   186 |
  | q06heo             |    89 |
  | vpvvir6wf5o        |   102 |
  | wmb62opntky        |    99 |
  | y4y7wbbov0w        |    92 |

  What is particularly anomalous about the above table is
  that nothing about the content changes in each edit.  The
  same content title, body, metadata is just repeated each
  time.
  
  === Update Proposal Approve ===
  
  The following chart shows how many approval/unapproval
  broadcasts that DERP-1728 makes on a given day.
  
  | Date       | Approve | Count |
  |------------|---------|-------|
  | 2019-11-21 | X       |    67 |
  | 2019-11-21 |         |    58 |
  | 2019-11-22 | X       |    98 |
  | 2019-11-22 |         |   113 |
  | 2019-11-23 | X       |    62 | 
  | 2019-11-23 |         |    47 |
  | 2019-11-24 | X       |    38 |
  | 2019-11-24 |         |    46 |
  | 2019-11-25 | X       |   202 |
  | 2019-11-25 |         |   196 |
  | 2019-11-26 | X       |   138 |
  | 2019-11-26 |         |   147 |
  | 2019-11-27 | X       |   164 |
  | 2019-11-27 |         |   178 |
  | 2019-11-28 | X       |    64 |
  | 2019-11-28 |         |    73 |
  | 2019-11-29 | X       |   375 |
  | 2019-11-29 |         |   364 |
  | 2019-11-30 | X       |   232 |
  | 2019-11-30 |         |   214 |
  
  === Account Witness Votes ===
  
  Similar anomalous behavior, but for witness approval.
  
  | Date       | Approve | Count |
  |------------|---------|-------|
  | 2019-10-15 | X       |   213 |
  | 2019-10-15 |         |   207 |
  | 2019-10-16 | X       |   111 |
  | 2019-10-16 |         |   111 |
  | 2019-10-17 | X       |   201 |
  | 2019-10-17 |         |   201 |
  | 2019-10-18 | X       |   104 |
  | 2019-10-18 |         |   104 |
  | 2019-11-09 | X       |   179 |
  | 2019-11-09 |         |   180 |
associated_accounts:
  - crystalliu
  - liuyifeifansclub
  - crystalliufans
  - dlivetv
  - crystal.liu
  - sistar
  - crystal-liu
  - rubyself
  - crystalliu825
  - steemflagreward
  - gormos
  - botconnect
  - genisys
  - operation
  - botservice
  - authorreward
  - lovecrystalliu
  - chaumet
  - mauser
  - bcctoken
  - bravesoftware
  - communist
  - communistparty
  - crystalliuyifei
  - easonchan
  - eosfinex
  - freemason
  - genesisdtuber
  - greatestdtuber
  - hangseng
  - hangsengbank
  - hongkongpolice
  - huangxiaoming
  - huobitoken
  - i-cable
  - joechen
  - jpx
  - kyber
  - liuximeizi
  - liuyifei
  - loselifesavings
  - luisfonsi
  - lyf
  - mainland
  - memehk
  - mysteemwallet
  - neogas
  - ponzischeme
  - protocollabs
  - ripiocredit
  - sovietunion
  - standardoil
  - steemaddress
  - steemfucker
  - steempowerplant
  - tissot
  - tsuburaya
  - ultramanzero
  - victoryeung
  - violence
  - weirenminfuwu
  - willwarren
  - yangyangicon
  - yifeiliu
  - youtubefucker
  - zeroex
  - zhaowei
related_links:
  - https://github.com/themarkymark-steem/buildawhaleblacklist/commit/3077ef7999313611060dfd13d7c0710450b7a7c0#diff-53c55df0c4ad29ee127fb2e4d0ade6dbR3233
  - https://github.com/themarkymark-steem/buildawhaleblacklist/commit/06bf4bfcbe64b619d4e58073ed17874854f56826#diff-53c55df0c4ad29ee127fb2e4d0ade6dbR18969
  - https://steemit.com/@crystalliu/7eweij3a3ix
  - http://scribe.steemian.info/?url=https%3A%2F%2Fsteemit.com%2F%40crystalliu%2F7eweij3a3ix

Comments

[test-safari]

Note: DERP-1728 also leverages delete_comment operations extensively to, in part, obfuscate vote farming. In some cases, a comments is created and deleted within the same block. (Or, deleted and then 'undeleted'.) This caused database inconsistency issues in earlier versions of hivemind, and quite possibly other content indexers.

[inertia]

I did not highlight that in the report because lately it hasn't been as bad. Here's the daily delete_comment operations count for all known accounts related to DERP-1728:

Date	Count
2019-11-16	45
2019-11-17	73
2019-11-18	81
2019-11-19	31
2019-11-20	56
2019-11-21	43
2019-11-22	56
2019-11-23	43
2019-11-24	62
2019-11-25	31
2019-11-26	48
2019-11-27	49
2019-11-28	29
2019-11-29	72
2019-11-30	50
2019-12-01	47

Of those deleted since 2017-11-09 01:35:27 UTC, the direct auction author rewards were: 124.105 SBD + 1931.371 STEEM + 4.74 MVESTS

That's actually pretty staggering. And I don't have a way to query what the nested replies of the deleted comments were.