This post will explain one of the latest scams on our blockchain and how we can avoid it. We have thousands more such accounts.
A Fake Proposal Scam!
I learned about this new scam yesterday when I read the chats on the Hivewatchers Discord Server. As you can read from the comment by @hivewatchers, a lot of accounts were used to upvote a fake proposal https://peakd.com/me/proposals/333.
Most of these accounts were new accounts created in the last month and had no HP in them. Then how did they manage to get 14K worth of delegations (207 HP each)?
That's exactly what I am here to explain. I am a moderator at Ecency, so I had an idea but 14K worth of HP seemed a lot, so I had to dig deeper to find out what was happening. This is where my rusty SQL and Python skills helped me. But more on that later.
Ecency Reward System — POINTS
Ecency has a reward system for using its platform (like many other front-end). There is a token (not listed on exchanges) called Points.
You can earn Points in a lot of ways:-
- Creating a post - 15 Points
- Comment - 5 Points
- Upvote (100% Vote) - 1 Point
- Reblog - 1 Point
- Login into Ecency - 10 Points
Etc.
And the subsequent operation will give you fewer and fewer Points. Say, for the first vote of the day, you get 1 Point but for the next upvote, you will only get 0.9 Points and so on. This is a good way to reduce Points farming and it works well.
(You can also buy these Perks with money from the Ecency App)
These Points can be used for some Perks like
- Promoting Your Post on Ecency - 150 Points for 1-day promotion, 250 for 2 days, etc
- Boosts+ - Spend 1500 Points to get ~200 HP delegation for 7 days, 6000 Points for 30 days etc
I love the Promotion perk and used it a lot. But always thought that Boosts+ is a bit too expensive. Earning 1500 Points takes a while if you have just one account and are not too active or engaging. But not if you have thousands of such accounts!
My Findings
8700+ accounts (mostly new accounts created in December + likely some other stolen accounts) were used to earn points for 3 days. Each of those accounts had enough RC to Reblog and Upvote a few posts, which earned them anywhere between 10–20 Points. These points were sent to a few accounts which distributed 1500 Points to those ~70 accounts (mentioned by @hivewatchers) which were used to buy 207 HP worth of delegations for 7 days.
These accounts were able to gather a whooping ~ 170K Points. The total number of accounts involved with these Points transactions is more than 8700. I have uploaded a list of all accounts I found which are connected which this group and involved in sending or receiving Ecency Points to this link: https://filebin.net/esejxc9u7sruml4h
- 'all_names.txt' contains a list of 8735 usernames involved in this Fake Proposal scam.
- 'already_blacklisted.txt' contains a list of usernames already blacklisted by Hivewatchers. (4851 accounts)
- 'not_blacklisted.txt' (3884 accounts) not yet Blacklisted by Hivewatchers. (last checked a few hours ago).
(I can give you these lists on Discord too, if someone is having trouble downloading them. Discord: @pravesh0)
How can we avoid such scams? Possible Solutions.
I would not blame Ecency for this at all. Rather, the blame goes on how they managed to create thousands of accounts within a couple of days. To my limited knowledge, Ecency was not used to create them. It was just used to gain some Points. Regardless, I have a suggestion for the @ecency dev team too which I will convey to them after this post as well.
Giving delegations to only Rep 40 or above? (maybe even 50?) I know 200 HP is not a small amount of beginners who can benefit from it the most, but you can get to 40 Reputations with a few good posts anyway. This will help to cut a lot of such scams in the future.
@good-karma what do you think? And how about blacklisting all these 8735 accounts for earning any more Points?
We need to stop these mass account creations… and I don't think these scammers are buying accounts when creating them. Somehow they keep creating thousands of accounts for free and the genuine users are not able to. (I might be wrong here).
Thanks to @arcange for his amazing work with HiveSQL. It was fun working with it. I was running SQL queries after 4 years, and it was a lot of fun for the most part (and a mess sometimes XD).
