Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review · Jewelbug APT
- Sequence
- #4
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457951174
- Off-chain at
- 2026-10-17T07:19:04.831Z
- Anchored at
- 2026-10-17T07:19:21.383Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 3V2PzExqJXMRG5Bzg6wH2HTh7szoxkPusKXzVU4xTT7N
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2130 chars)
{"actor":"reviewer","artifact_identity":"090910e20e17f90071ff98d9a1cb727a","decided_at":"2026-10-17T07:19:04.601Z","decision":"review","disputed_pct":0.2609,"findings_hash":"3erweaPvQWJ4LfQbJMbAcfxLnVH9bARcB18DL4tFGsjS","investigation_id":"d85d31d4-5ac7-4267-8d7f-95285282f1a9","mode":"findings_only","new_score":0,"page_content_hash":"e56d2d9d3022fc5fb93bb7f2d8b80496870a0a0d51a983e20975a5bc9b139144","page_slug":"jewelbug-apt","prev_score":0,"reason":"This page is unusually well-sourced for an AVOID.NET entry: nearly every factual claim -- the dual espionage/crypto-fraud mission, the Hunan/Changsha operator identity, the XG-Web architecture, the Antino and ClientKing malware, the 15+ government webmail tenant compromise, and all headline data-theft figures -- was independently verified against Symantec's own 28-page primary dossier and checks out precisely, including an exact verbatim quote ('the combination of two missions in one set of hands'). Two defects stood out: the claim that malware samples trace back to 2013 appears nowhere in the cited primary source or in any secondary source checked, and the dossier's own timeline shows no activity before ~2024, making this likely a fabricated or badly conflated data point (repeated in both the Attribution section and the timeline). Separately, the page states '57 variants of ClientKing' where both the primary dossier and an independent outlet (TechTimes) say 37; the accompanying aerospace-proxy detail in the same sentence is accurate and should be preserved. A minor issue bundles six outlets' coverage under a single August 13, 2026 timeline date when at least two (The Hacker News, and likely Infosecurity Magazine) published August 14 per the page's own archive timestamps. Two cited URLs (Dark Reading, TechNadu) could not be directly fetched for this review due to bot-blocking (HTTP 403), though both have live wayback archives recorded in sources_used and their claims were independently corroborated elsewhere.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}