Two weeks ago, a phishing bot commented on my post. Vietnamese text, on-topic, ending with a link to labagent.tech . Click it and you got a fake dev.to login page.

I reported it. Another appeared. Then another. Same pattern, different accounts, all created the same day.

So I built a scanner. The idea came from Harun ( @koda2026 ), who built the original Tiger Sentinel to protect his own posts. I expanded it into a daily scan.

What it does

Scans dev.to's public API. For each article, fetches comments and scores them against two tiers of signals.

Strong (2+ needed to flag as reportable):

Known phishing domains

Two or more impersonation phrases ("verify your account", "you have 24 hours")

Shortlink + Vietnamese text

Shortlink + near-empty comment

Shortlink + bot-style username

Weak (review only):

Single shortlink

Single impersonation phrase

The two-tier scoring is the whole trick. The first version flagged every comment with a link at the end — 313 findings, most legitimate.…