<center>
https://files.peakd.com/file/peakd-hive/keys-defender/23x1NDqrpU8f5RRStK5G72vt2ZdyxH4CgYXug5wUgFZNJRLEVHjs56WtqAt1yTcKNjv5i.png
</center>

<br>
Following up on the previous work I did to counteract phishing (1. [auto-replies](https://peakd.com/hive/@keys-defender/new-feature-phishing-detection-and-auto-reply) and 2. [universal script to block phishing links in all Hive frontends](https://peakd.com/hive-139531/@keys-defender/phishing-on-hive-no-more-solution-for-all-frontends)) I now present a way for the <b>Hive community</b> to actively participate and <b>timely stop phishing campaigns</b>.

<br>
<h4>How does it work?</h4>

As soon as you spot a phishing link targeting the Hive ecosystem and being spammed on any platform (one of the Hive frontends, Discord, etc), post <i>on any Hive frontend</i> a comment structured in this way:

- Mention @keys-defender
- Include the command "!phishing"
- Add the phishing link - eg. https://givemeallyourhoney.com/airdrop

<b>Outcome:</b> @keys-defender will add the reported phishing domain to its banlist and it will immediately start [replying to the phishing comments](https://peakd.com/thisjustinnewsnew880412/@keys-defender/antiphish-keys-defender-bot-1615674746361) and [counteracting the transfer memos](https://peakd.com/hive-139531/@keys-defender/new-feature-phishing-protection-for-hive-wallet-transfers) in order to timely warn users against the phishing campaign.


<b>Usage example:</b>

https://hive.blog/hive-148441/@keys-defender/qq9fz0

![image.png](https://files.peakd.com/file/peakd-hive/keys-defender/23tHb6kVaQK7uywpXYaGnHjK3N1WVctGjqNJv4vMBYYtkSj5S1qaCmosfGYJJ2LAfRBgg.png)

-----

<br>
<h4>Who controls the banlist?</h4>

Can anyone add a domain to the banlist? Kind of. In order to prevent abuse, some limitations are in place.
The type of users that are able to immediately blacklist a domain are:
<div class="pull-right">
<sub><sub><sub>@blocktrades, @gtg, @good-karma, @ausbitbank, @roelandp, @steempress, @themarkymark, @steempeak, @peakd, @anyx, @pharesim, @arcange, @yabapmatt, @someguy123, @therealwolf, @stoodkev, @aggroed, @emrebeyler, @ocd-witness, @acidyo, @abit, @followbtcnews, @cervantes, @drakos, @quochuy, @curie, @lukestokes.mhth, @leofinance, @smooth.witness, @mahdiyari, @riverhead, @timcliff, @jesta, @threespeak, @guiltyparties, @holger80, @netuoso, @deathwing, @pfunk, @thecryptodrive</sub></sub></sub> <br><br><sub>(apologies for the mass tag)</sub>
</div>

- myself &nbsp; 👈
- Any top-40 witness &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 👉
- Any trusted user - current list &nbsp; 👇
<sub><sub><sub>@gaottantacinque, @hivewatchers, @hivewatcher, @spaminator, @enforcer48, @logic, @joshman, @shmooglesukami, @penguinpablo, @jlsplatts, @splatts, @anthonyadavisii, @steevc, @hiveseph,<br>@louis88, @saboin, @memehub, @antisocialist, @reazuliqbal, @r0nd0n, @edicted, @slobberchops, @taskmaster4450, @aggroed, @tarazkp, @drutter, @solominer, @steemseph</sub></sub></sub>

<br><b><u>Any other regular user can add domains to the banlist too</u></b> BUT.. at least 3 reports from different users with a reputation above 50 are required in order for the entry to be automatically added to the banlist.

<center>Example of regular user adding a phishing domain to the banlist:
https://hive.blog/hive-148441/@marcocasario/qq9gcd</center>

![image.png](https://files.peakd.com/file/peakd-hive/keys-defender/Eo8ZVfD93gDcQvz776o7zVu11Wu76MVudVEF9EAK4nuihPt471QjUWs46UwHaWAxQag.png)

<div class="pull-right">
<sub><center>👇 &nbsp; Logs</center></sub>https://files.peakd.com/file/peakd-hive/keys-defender/23t74jMiAVB1V3ZffFUHrweedJCJA7mo7jCkewhcUscbWsxvRbzhUK5dkzQPcky6Lr2u2.png
</div>

<br>
<h4>Perks:</h4>

Every report gets a ~ [$ 0.25 upvote](https://hive.blog/hive-138876/@keys-defender/qqaqs8). 
<sub>(Users that abuse this feature will get heavy downvotes from me and my flag trail)</sub>

-----

<br>
<h4>Futher countermeasures and Tracking:</h4>


Every single report triggers a notification to my [Discord server](https://discord.gg/SXuwsH7).
This allows me and the other volunteers (with a role assigned) in my discord to take action - eg. contact the hosting service to take the phishing website down.

This also allows us to have a record of who reported what (and every report is immutably stored in the Hive blockchain for everyone to see).

<center><sub>Discord notifications</sub></center>

![image.png](https://files.peakd.com/file/peakd-hive/keys-defender/Eo6DACPbz7i2DwcTfBku1g9LLwiRf8kJPSLwtjQPu8a9YoWSx3ry8w9CAZ917VDoCua.png)

<div class="pull-right">
<center><sub>Logs of the phishing-reports feature and Discord notification</sub></center>

![image.png](https://files.peakd.com/file/peakd-hive/keys-defender/23t752KFYoaUhk3VoTGmeVcgmQvKS2FEf43ZT5BdP2xWUjPajU6o3Pdd9SNBaPHbVBprY.png)
</div>


<br><br><br><br><br><br><br><br><br><br><br>
<h4>Where is the banlist stored?</h4>

It's stored in the Hive blockchain itself -> https://hive.blog/hive-193084/@keys-defender/phishing-db

![image.png](https://files.peakd.com/file/peakd-hive/keys-defender/23tmm5srF5jByTS1bhLDijAEgfwTvJdDWP53ZKoMRA26krRoHcxtyxgxbXXT3FHeyKLB6.png)

<br>

To see all the changes performed to it over time check out: &nbsp; [Hive Scribe](https://scribe.hivekings.com/?url=https%3A%2F%2Fhive.blog%2Fhive-193084%2F%40keys-defender%2Fphishing-db) or [Hive-DB](https://hive-db.com/hive-193084/@keys-defender/phishing-db/edits)
<br>

-----

<div class="pull-right">

![image.png](https://files.peakd.com/file/peakd-hive/keys-defender/242YUyDjGNBxeiiDA5Pv8kcCyGwkpjRA74wNs69r3VdbLWnawKpQwSMvdyiZuJkv6i2Ex.png)

</div>

<br>

<h4>Whitelist:</h4>

<b>What if a rogue user tries to ban a legit domain just to cause trouble?</b>

To prevent such scenario there is a domains whitelist in place. Meaning that if for example an attacker controlling 3 accounts with reputation above 50 tries to add to the banlist peakd.com in order to cause mass spam from @keys-defender, they won't be able to.


-----

<br>

<div class="pull-right">https://files.peakd.com/file/peakd-hive/keys-defender/23y8zBUvSiYp1HvqTF8Ln5dLgRRdmAfa7rLijKVCDCVbyqozwJQbREr44EWeVQXbtE9Sc.png</div>

<h4>Future development:</h4>

The list of community reported phishing domains is now in use by @keys-defender, meaning that after a domain gets added to the banlist, @keys-defender will immediately start replying to any new comment containing that link.

The <b><u>next step</u></b> is to <u>update and release a new version of<u> my [universal script for hive frontends](https://peakd.com/hive-139531/@keys-defender/phishing-on-hive-no-more-solution-for-all-frontends) so that all Hive frontends using it will not only consume @spaminator's api (that still needs a quick fix[]()), but also @guiltyparties's banlist and mine.

My phishing domains banlist will be an initial copy of @spaminator's plus all the community reported links.

<center>PS. see also [these other plans](https://peakd.com/hive-139531/@louis88/fighting-phishing-on-hive-2-solutions-to-better-deal-with-phishing-on-hive-your-feedback-is-needed#comments) posted shortly after.</center>

------
------

<div class="pull-right">
https://files.peakd.com/file/peakd-hive/keys-defender/23viGmwE9JNKdZtzXduTUqpB8h2xRp159Jq991A4aQ2Z9JY1CCcTo2Ug6t2krPUyx9ebE.png
</div>

<h4>Testers required</h4>

<b>Test plan:</b>

A. &nbsp; Myself blacklisting a domain - <B>[PASSED](https://hive.blog/hive-148441/@keys-defender/qq9fz0)</B>

B1. My non-whitelisted alt account with reputation above 50 reporting the testing domain https://steemispoop.com - <B>[PASSED](https://hive.blog/hive-148441/@marcocasario/qq9gcd)</B>
B2. &nbsp; 2 more accounts with reputation above 50 reporting https://steemispoop.com - <b>[PASSED](https://peakd.com/hive-139531/@cribbio/qqaie5)</b>

C. &nbsp; 1 account with reputation below 50 reporting a link - <b>[PASSED](https://peakd.com/hive-139531/@ticketyboo/re-keys-defender-qqah11)</b>

D. &nbsp; 1 top-40 witness reporting the testing domain https://phish-test-domain1.com - <b>[PASSED](https://peakd.com/hive-139531/@ausbitbank/re-keys-defender-qqazoj)</b>

E. &nbsp; 1 whitelisted user reporting the testing domain https://phish-test-domain2.com - <b>[PASSED](https://peakd.com/hive-139531/@saboin/re-keys-defender-qqaggn)</b>

F. &nbsp; Any account reporting a phishing link and forgetting to add the link (ie. "@keys-defender !phishing") - <B>[PASSED](https://peakd.com/hive-139531/@keys-defender/phishing-report-reply-1616275841178)</B>

G. &nbsp; Any account not including the mention to @keys-defender (PS. now supported) and reporting a phishing link already known - <B>[PASSED](https://hive.blog/hive-138876/@keys-defender/qqaqp0)</B>

H. &nbsp; Any account posting a comment with a link that has just been put in the banlist by other users - <B>[PASSED](https://peakd.com/hive-139531/@b0t5-t3sting/qqals2)</B>


<center><b>Please post your test comments as reply to <a href="/hive-139531/@keys-defender/re-keys-defender-qqafg6">this comment of mine</a>.<br>PS. All tests are now successful, thanks everyone!</b></center>

-----

<br>

<div class="pull-right">
<sub><b>My security disclosures for Hive:</b></sub>
<br><sub>- <sub><a href="https://hive.blog/hive-139531/@gaottantacinque/stored-xss-vulnerability-in-one-of-the-hive-frontends">XSS vulnerabilities in #########.com</a></sub></sub>
<br><sub>- <sub><a href="https://hive.blog/hive-139531/@gaottantacinque/defacement-phishing-vulnerability-in-one-of-the-most-used-hive-tools">XSS vulnerabilities in hive-db.com</a></sub>
<br>- <sub><a href="https://hive.blog/hive/@gaottantacinque/xss-found-in-one-of-drako-s-websites-will-add-details-after-it-s-patched">XSS vulnerabilities in scribe.hivekings.com</a></sub>
<br>- <sub><a href="https://hive.blog/hive/@gaottantacinque/hiveblockexplorer-com-is-vulnerable-to-stored-xss">XSS vulnerabilities in hiveblockexplorer.com</a></sub>
<br>- <sub><a href="https://hive.blog/steemit/@gaottantacinque/steemit-got-hacked">Malicious ads redirecting all Steemit iOS users to a phishing site</a></sub>
<br>- <sub><a href="https://hive.blog/security/@gaottantacinque/steemit-chat-is-unsafe">Reverse tabnabbing and clickjacking in steem.chat and steeemit registration page</a></sub>
</sub>
<br><br>
<sub><b>Other contributions:</b></sub>
<br><sub>- <sub><a href="https://hive.blog/hive-139531/@keys-defender/phishing-on-hive-no-more-solution-for-all-frontends">Universal script to prevent phishing in all Hive frontends</a></sub></sub>
<br><sub>- <sub><a href="https://peakd.com/hive-169321/@keys-defender/new-commands-and-ban-lists">Commands for community reports and ban lists</a><br><br></sub></sub>
</div>

<b>Keys-Defender features:</b><div class="pull-left">
<div>
- <sub><a href="https://hive.blog/steem/@gaottantacinque/the-keys-defender-bot-is-live-in-beta-mode"><b>Keys protection</b></a><sub>[live scan of transfers / posts / comments / other_ops. Auto-transfers to savings, auto-reset of keys, ..] {see automatic <a href="https://hive.blog/hive-138876/@keys-defender/keys-defender-compromised-posting-key-successfully-detected">posts on leak</a> and <a href="https://hive.blog/hive/@keys-defender/successfullyprotected-1600122002275">monthly reports</a>}</sub></sub>
<br><i>-</i> <sub><a href="https://hive.blog/hive/@keys-defender/new-feature-phishing-detection-and-auto-reply"><b>Phishing protection</b></a>
<sub>[live scan of commentsa and posts to warn users against known phishing campaigns and compromised domains, scan of memos]</sub></sub>
<br><i>-</i> <sub><a href="https://hive.blog/hivedev/@keys-defender/new-feature-added-to-keys-defender-plagiarism-detection"><b>Re-posting detection</b></a>
<sub>[mitigates the issue of re-posters]</sub></sub>
<br><i>-</i> <sub><a href="https://hive.blog/hive-139531/@keys-defender/new-feature-code-injections-attempts-detection-xss-sql-injections-csrf"><b>Code injections detection</b></a>
<sub>[live scan of blocks for malicious code targeting dapps of the Hive ecosystem]</sub></sub>
<br><i>-</i> <sub><a href="https://hive.blog/hive-192847/@keys-defender/anti-spam-efforts"><b>Anti spam efforts</b></a>
<sub>[counteracts spam from hive haters]</sub></sub>
<br><br>
</div>
</div>

-----

<br>
<div class="pull-right"><sub>Please don't forget to <b>upvote and reblog!</b><br><a href="https://hivesigner.com/sign/delegateVestingShares?delegator=&delegatee=keys-defender&vesting_shares=50%20SP">Delegations</a> and follows to my <a href="https://hive.vote/dash.php?i=2&fan=keys-defender">fanbase</a><br>are welcome too! &nbsp; =]<br></sub></div>
<br>
Take care,
@keys-defender (@gaottantacinque)