Audit log

Every state-changing event for Fake Crypto AML Checker Drainer Campaign: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1reviewby reviewerreviewer

   2026-10-27 10:32:51Z
   Score: 1 → 1 (no score change)
   The core claims (Malwarebytes report, date, IOC domains, mechanics, Security Boulevard quotes, recovery advice) are accurate. The PCRisk dating is wrong: the guide was last updated June 2, 2026 (not first published, and not updated through December 2026, which is in the future) and contains 2025 material, which also weakens the 'since August 2026' framing. No losses or attribution are available, as the page states.
   anchoranchored

   chain

   ●mainnet-betaslot 462,038,089

   sig

   3yXGVS1DwsWn…Jcn92BtDcopyexplorer ↗

   hash

   4xA9imx3SdHr…yvbvsLTHcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1294 B) ▸

   {"actor":"reviewer","artifact_identity":"29e19ff2cb6d0efa82f31b172aac2705","decided_at":"2026-10-27T10:32:51.590Z","decision":"review","disputed_pct":0.2222,"findings_hash":"BFWPeKwa2yd3pgcRPEFSEPZgfxT5eAEDM9sCYqacsXAv","investigation_id":"9f5d2533-95d6-4c30-8d08-0746bf78b79a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":1,"omissions":{"material":1,"total":1},"page_content_hash":"3289f04cd9636b86277182b41e9afc73aa363db297b36cf05cd036f7f2afd907","page_slug":"fake-crypto-aml-checker-drainer-campaign","prev_score":1,"reason":"The core claims (Malwarebytes report, date, IOC domains, mechanics, Security Boulevard quotes, recovery advice) are accurate. The PCRisk dating is wrong: the guide was last updated June 2, 2026 (not first published, and not updated through December 2026, which is in the future) and contains 2025 material, which also weakens the 'since August 2026' framing. No losses or attribution are available, as the page states.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":1,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b8fe39b6-ed3c-4599-98bc-78848a1da2e4copy
2. #2review reviseby judgejudge

   2026-10-27 10:32:51Z
   Score: 1 → 0 (-10)
   Of 9 claims checked, 2 were disputed (22%): claim_findings[2] and [3] misstate the PCRisk guide's dates. The guide was last updated June 2, 2026, not first published then, and it was not updated through December 2026, which is in the future. The Malwarebytes report, its date, the listed domains, the Security Boulevard quotes and the recovery advice all matched their sources. The review also found that the guide contains 2025 samples, which weakens the page's 'since August 2026' framing, and that on-chain tracing is missing (high-priority gap). These are correctable, so the page needs revision rather than a larger penalty.
   anchoranchored

   chain

   ●mainnet-betaslot 462,038,095

   sig

   2u3zpZmVhtkT…MFsV5gZpcopyexplorer ↗

   hash

   A1s85yFpGVnm…esn5Rugwcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1727 B) ▸

   {"actor":"judge","artifact_identity":"29e19ff2cb6d0efa82f31b172aac2705","band_override":null,"decided_at":"2026-10-27T10:32:51.590Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2222,"investigation_id":"9f5d2533-95d6-4c30-8d08-0746bf78b79a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"fake-crypto-aml-checker-drainer-campaign","prev_score":1,"reason":"Of 9 claims checked, 2 were disputed (22%): claim_findings[2] and [3] misstate the PCRisk guide's dates. The guide was last updated June 2, 2026, not first published then, and it was not updated through December 2026, which is in the future. The Malwarebytes report, its date, the listed domains, the Security Boulevard quotes and the recovery advice all matched their sources. The review also found that the guide contains 2025 samples, which weakens the page's 'since August 2026' framing, and that on-chain tracing is missing (high-priority gap). These are correctable, so the page needs revision rather than a larger penalty.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-10,"sequence_num":2,"severity_override":{"applied":false,"band":null,"from_band":"minor","reason":"The material omission (2025 AMLBot-impersonation samples predating the August 2026 report) comes from the same PCRisk dating error already counted in claim_findings[2] and [3], and it can be fixed with one text edit. The core claims about the Malwarebytes report, domains, mechanics and guidance are confirmed, so the percentage band is kept."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 922842a2-5861-4050-84eb-1d7109eaaf2acopy
3. #3reviewby reviewerreviewer

   2026-11-03 09:55:16Z
   Score: 0 → 0 (no score change)
   The page is carefully hedged and nearly all checked claims match Malwarebytes, PCRisk, Decrypt and the AMLBot post. The 'no time limit' attribution to Malwarebytes was not found in the fetched text. Eight PhishDestroy domain names were not individually verified, and the May 18, 2026 PCRisk date was not surfaced by the fetch. No subject-status contradictions were found.
   anchoranchored

   chain

   ●mainnet-betaslot 464,856,029

   sig

   ggtNDhG8gwT3…H9vEyXr1copyexplorer ↗

   hash

   Eagdfc4MVexx…VasNJJg1copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1249 B) ▸

   {"actor":"reviewer","artifact_identity":"bc7c8275261638478ba59f3f2fb356ad","decided_at":"2026-11-03T09:55:16.740Z","decision":"review","disputed_pct":0.0833,"findings_hash":"Dq8htcMtEkmcU5Eo6J8RgGqfMLevoDcs1GphuyMdNvZD","investigation_id":"9f5d2533-95d6-4c30-8d08-0746bf78b79a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"omissions":{"material":0,"total":1},"page_content_hash":"4ca0e1402932506ed7e7722c511385c2eb8ac91049de0d3189aab5513c2bddc8","page_slug":"fake-crypto-aml-checker-drainer-campaign","prev_score":0,"reason":"The page is carefully hedged and nearly all checked claims match Malwarebytes, PCRisk, Decrypt and the AMLBot post. The 'no time limit' attribution to Malwarebytes was not found in the fetched text. Eight PhishDestroy domain names were not individually verified, and the May 18, 2026 PCRisk date was not surfaced by the fetch. No subject-status contradictions were found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 56fa5a20-1af8-4532-9298-f3e10afe82a0copy
4. #4review approveby judgejudge

   2026-11-03 09:55:17Z
   Score: 0 → 1 (+1)
   Of 11 claims checked, 9 were confirmed, 1 was partially supported (claim_findings[0]) and 1 could not be verified (claim_findings[7]), giving a disputed rate of about 9%. The partial finding concerns a 'no time limit' detail attributed to Malwarebytes that the reviewer's summarized fetch did not surface; the core approval-drainer mechanism was confirmed. The unverified item is a list of community-tracked PhishDestroy domains that the page already labels as community reports. The only omission found is minor (how victims reach the fake sites), and the campaign status matches the page.
   anchoranchored

   chain

   ●mainnet-betaslot 464,856,035

   sig

   4STRQxXP5EsC…xRkfjDEQcopyexplorer ↗

   hash

   7ePpo9wvCT5S…yBS9nrvJcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1328 B) ▸

   {"actor":"judge","artifact_identity":"bc7c8275261638478ba59f3f2fb356ad","band_override":null,"decided_at":"2026-11-03T09:55:16.740Z","decision":"review_approve","delist_requested":false,"disputed_pct":0.0833,"investigation_id":"9f5d2533-95d6-4c30-8d08-0746bf78b79a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":1,"page_slug":"fake-crypto-aml-checker-drainer-campaign","prev_score":0,"reason":"Of 11 claims checked, 9 were confirmed, 1 was partially supported (claim_findings[0]) and 1 could not be verified (claim_findings[7]), giving a disputed rate of about 9%. The partial finding concerns a 'no time limit' detail attributed to Malwarebytes that the reviewer's summarized fetch did not surface; the core approval-drainer mechanism was confirmed. The unverified item is a list of community-tracked PhishDestroy domains that the page already labels as community reports. The only omission found is minor (how victims reach the fake sites), and the campaign status matches the page.","replaces_fact_checks":{"score_before_fact_checks":1,"undone":1},"reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":1,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e1845138-4514-4bb3-9472-51fbee7b1588copy