Hey DEV Community! 👋
I’ve been spending a lot of time here lately, reading incredible articles, sharing my own journey building a 142KB AI app on a $150 phone, and learning from all of you.
But recently, I noticed a nasty pattern hiding in the comment sections of multiple posts.
If you’ve been on Dev.to lately, you might have seen a comment that looks exactly like this:
DEV SUPPORTS • [Recent Date]
Official Platform Update
Security protocols have been updated for all developer accounts.
tr.ee/dev-to
At first glance, it looks official. It has the Dev.to logo. It uses urgent language. But this is a phishing scam. 🚨
I’ve called it out in the comments every time I see it, and I want to break down exactly why this is dangerous and how you can protect yourself (and your fellow developers).
🕵️♂️ The Anatomy of the Scam
Let’s dissect why this comment is a massive red flag:
- The Fake Urgency: "Security protocols have been updated" is a classic social engineering tactic. It’s designed to make you panic and click without thinking.
-
The Sketchy URL:
tr.eeis a third-party link shortener. Dev.to will NEVER ask you to verify your account via a third-party link shortener in a comment section. Real platform updates happen via official emails from@dev.toor native in-app notifications, not random comments. -
The Bot Account: Notice the username:
suppdevbot. It’s designed to look like "Dev Supports," but it’s just a compromised or newly created bot account spamming the same copy-pasted message across dozens of popular articles.
💀 Why This is Dangerous
If you click that link, it doesn’t take you to Dev.to. It takes you to a fake "verification" page. These pages are designed to look like a login screen. If you enter your Dev.to credentials (or worse, your GitHub/Google login), the attackers steal your account. From there, they can:
- Post more spam from your trusted account.
- Access any private repositories linked to your profile.
- Use your reputation to scam other developers.
🛡️ How We Fight Back (The Community Defense)
The good news? The Dev.to community is sharp, and we are catching it every time.
Whenever I see this comment, I reply with a loud, clear warning:
"THIS IS A PHISHING SCAM 🚨 Do not click this link. Dev.to will never ask you to verify your account via a third-party link in the comments."
I’ve also seen other awesome community members doing the exact same thing. This is what a healthy, self-policing community looks like. We protect our own.
✅ Your Action Plan
If you see this comment:
- DO NOT CLICK THE LINK.
- Reply with a warning so others scrolling by see it immediately.
- Use the "Report" button on the comment to flag it to the real Dev.to moderation team.
- Spread the word. Share this article with your dev friends, especially juniors who might not recognize the red flags yet.
💡 The Takeaway
We spend hours writing secure code, validating inputs, and protecting our users from vulnerabilities. Let’s apply that same security-first mindset to how we navigate the web.
Stay sharp, verify your sources, and keep building amazing things.
Have you seen this scam on other platforms? How do you spot phishing attempts? Let’s discuss in the comments! 👇🐯
Top comments (13)
I reported this user. Thank you for warning! 👍
nyaomaru, thank you for reporting them! community defense is the best defense. we protect the pack! 🐯🛡️
I forgot to say, The comment was also posted on Oct 12 on my post. Should I report the account? That might not be the best because they will just create another account. Keep the account and try to get as much info as possible? Like all 303 comments in 2 days😱. Im 13 and will be a detective when I grow up. Anything else I can do? This really interests me.
forkcount, first off: future detective, you are already thinking exactly like a senior security analyst. 🕵️♂️🐯
to answer your question: yes, absolutely report the account. dev.to moderators need that data to map the IP and behavioral patterns. every report trains the platform's filters.
but here is the real answer: since this genuinely interests you, i am going to do something a little crazy.
i built "tiger sentinel" to hunt these exact scams. the detection logic works perfectly. however, dev.to's api blocks automated posting, so i archived the auto-posting part to focus 100% on my main project, KODA.
but the scanner? it belongs in the hands of a 13-year-old detective who actually cares about this.
i am willing to officially transfer the GitHub repository ownership to you. HOWEVER, as the original creator, i have two conditions for the handover:
If you agree to those terms, reply with your GitHub username, and i will initiate the transfer. let's run this joint detective agency! 🤝🔍
Is there anther way can contact you? like email? I'm afraid I might get blocked from commenting too much to you. And the spammers can read it too. [email protected] You can send the link. Python doesn't seem to work on my computer but I'll find a way. I thought bots were banned on dev.to otherwise I'd be making a similar bot that runs on the a tab beside dev.to then jumps to dev.to and scans for labgent then other links. But I change this, I runs from somewhere that has no access to my computer and it clicks the links and records what is on there. But that is when I found a safe place to put my bot and if dev.to allows it.
nicky, since you are already diving into the code and asking all the right architectural questions, i want to make this official.
you are exactly the right person to take this forward. i want to transfer the full ownership of the tiger sentinel github repository to you. it is 100% free, no strings attached, just passing the torch to a fellow detective who actually cares about this.
all i need from you is your github username. once you reply with it, i will initiate the transfer. (and as we discussed, you just add me back as a "maintainer" collaborator afterward so we can co-manage it and keep the community safe together).
let me know your username, and let's make it official! 🐯🤝
forkcount, gmail's spam filters just aggressively blocked that email address (it flagged the domain as a temporary/burner service). even your email provider is testing your OPSEC! 😂
to keep this secure and ensure the email actually lands, could you reply with a standard gmail or protonmail address?
alternatively, i can just make the github repo public right now and drop the link in a direct message here on dev.to. let me know which you prefer, detective! 🕵️♂️🔒
Cảm ơn bạn đã chia sẻ case study thực tế này — rất ít người viết chi tiết đến mức "phân tích dissection" luồng tấn công kiểu này.
Điểm tôi thấy nguy hiểm nhất không phải là link độc hại (dev.to đã sanitize khá tốt), mà là kỹ thuật social engineering kết hợp UI spoofing: kẻ tấn công lợi dụng thói quen "click profile -> xem bio -> trust external link" của dev. Khi profile trông legitimate (avatar thật, bio viết kỹ, có vài bài viết repost), cơ chế "trust by association" của não bộ sẽ bypass cảnh giác.
Một vài pattern tôi hay thấy thêm trong wild và值得注意 (worth noting):
Websitefield của profile (ví dụGithubvsGithhub,dev.tovsDev Community). Mobile view rất khó nhận ra.**Tip thực chiến PS: the tool I meant is on labagent .tech
traceypears, cảm ơn bạn đã chia sẻ những góc nhìn bảo mật thực chiến này!
phân tích của bạn về "sự tin tưởng do liên kết" (trust by association) và chiến thuật "hỏi ngược" (reverse question) là hoàn toàn chính xác. kẻ tấn công đang vũ khí hóa các luồng bình luận để vượt qua các bộ lọc liên kết cơ bản.
điểm mù về typosquatting trong bio và các tài khoản lâu năm bị hack (hijacked legacy accounts) là một lỗ hổng lớn mà hầu hết các nền tảng đều bỏ qua. báo cáo từ cộng đồng thực sự là quá thụ động (reactive). chúng ta cần những biện pháp phòng ngừa chủ động, có hệ thống như tự động mở rộng URL rút gọn và gắn cờ các tên miền mới đăng ký, chính xác như bạn đã đề xuất. phân tích xuất sắc! 🐯🛡️
Hey Harun — saw your posts about hunting phishing on dev.to. I got one on my post. A user called mp6nfjxhrlxc left a long technical comment in Vietnamese, and it ended with a link to labagent.tech. The comment itself looks real, but the URL has nothing to do with my app. I think it's a spam bot. Thought you'd want to know — you can see it in the comments on my post "I built a free calorie tracker with a metabolic safety floor."
Also — you got hit too. On your "I Found a Phishing Scam Hiding in Dev.to Comments" post, there's a comment from xxejktefwfjk, October 12, same pattern, Vietnamese text, ends with labagent.tech. Same link as mine. So it's not random. It's the same operation hitting multiple posts today.
forkcount, thank you so much for flagging this! This is exactly the kind of community intelligence that keeps the platform safe. 🙏
you nailed it. the "long, highly technical comment in vietnamese ending with a seemingly benign link" is a sophisticated, coordinated spam bot pattern. they are using AI to generate relevant text to bypass basic spam filters, then slipping the
labagent.techlink at the very end to build false trust.i am adding this specific domain and behavioral pattern to the tiger sentinel's detection heuristics immediately. thank you for having a sharp eye, applying the knowledge, and looking out for the community. stay safe! 🐯🛡️
Cảm ơn bạn rất nhiều vì đã chia sẻ những kiến thức bảo mật thực chiến này! 🙏
Tư duy coi mọi đường link trong phần bình luận là "dữ liệu đầu vào không đáng tin cậy" (untrusted input) và áp dụng tư duy "sanitize input" giống như khi code là một góc nhìn cực kỳ xuất sắc. Nó kết nối hoàn hảo giữa lập trình bảo mật và thói quen lướt web hàng ngày.
Cảnh báo về tấn công giả mạo Unicode (homograph attack) và mẹo "copy paste vào notepad" để kiểm tra là những mẹo ở trình độ chuyên gia. Hầu hết mọi người đều quên rằng phần xem trước bình luận không hiển thị cảnh báo Punycode của trình duyệt, nên việc kiểm tra bằng text thuần túy thực sự là một cứu cánh.
Những đề xuất ở cấp độ nền tảng của bạn cũng rất chính xác. Tự động mở rộng các URL rút gọn và gắn cờ (flag) các tên miền được đăng ký dưới 30 ngày chính là những giải pháp chủ động mà Dev.to cần để chuyển từ việc báo cáo thủ công sang phòng ngừa thực sự.
Cảm ơn bạn đã mang đến những kiến thức bảo mật chất lượng cao và cực kỳ thực tế cho cộng đồng! 🐯🛡️