#bpspam — Public Fediverse posts

@iftas do you have any info where this #bpSpam come from ?

Mastodon and forks allow banning the use of certain usernames at /admin/username_blocks – this will stop emails going out as the username cannot be chosen, but it will stop any and all usernames (including valid requests) containing “bp” – this should be considered a temporary measure.

#bpSpam

The good news: we are now at 20 million accounts created on the network.

The bad news, it's #bpSpam

@m0bi thanks for this screenshot!

So, the IP addresses in Poland are also all Japanese, just like in .cz ... so this must have happened

I am tempted to link it to recently disclosed serious bug in Mikrotik routers, but it would not explain why two distinct central European instances were attacked only by Japaneese IPs... it might have been some BGP injection on the the level of Europe - Japan backbone link... which are probably not so many...

Your 3 IP addresses are also not known for anything special in major blocklists - just like ours here. So this is very different from usual low intensity background activity via tor exit nodes, which was happening for years, already.

This was not natural script kiddie decay... this was explosion, seismic-level event. And probably of centralized nature (not botnet?)... I dunno, but want to discuss...

#bpspam cc @gandalf

RE: https://mastodon.uy/@admin/117252888276120218

Now, this is ultra interesting: while ALL IP addresses used by this botnet in #Czech Republic were IP addresses registered to various Japanese companies, with no previous abuse history, the IP addresses used by obviously the very same botnet using exactly the same usernamespace in #Uruguay are registered to USA, Nigeria and Pakistan, also without any previous abuse history (at the first glance). And I am no security expert, but it seems to me, that it is not easy to just throw pool of hundreds previously unused compromised IP addresses from many unrelated networks in the game...

This looks like BGP injection - someone pretending for a short time being Japanese telco in our country or being some USA/Nigeria/Pakistan telco in Uruguay.

With more screenshots like this, we may be actually able to triangulate the network, from which the attach came. It would really involve contacting our upstream providers with more detailed attack descriptions, IP lists, and so. (I believe the fake e-mails trace is irrelevant in this case, it won't help much).

Please, correct me if I am wrong.

Also, the normal-state tracerouting to the IP addresses involved (from multiple countries) may help to detect the compromised telco (someone my just have their core router hijacked... and it would be really interesting to know the manufacturer name...)

Let's make the federated investigation into this overwhelming for the attacker...

cc @iftas @admin @tante @gandalf

#mastodon #botnet #bpSpam

#FediAdmin #BpSpam

What is the frequency everyone is getting these? I got a hand full a day for maybe 2-3 days. And then I havnt gotten any so far after that.

#MastoAdmin

... aaand another 136 today

I've just used postgres to export a list of unapproved users with signup IPs into a .csv to add to my firewall blacklist:

copy (select id, sign_up_ip, email, approved from users where approved = 'f') to '/tmp/pendingusers.csv' with CSV DELIMITER ',' HEADER;

I'm not sure how effective it will be, as IP addresses are from all over the place, none are duplicates, but never mind, it's worth a try. 😡

Edit: #bpSpam

Due to the recent #bpSpam wave, I have temporarily turned off registration completely. Luckily we were requiering manual approval for all new accounts, so no harm was caused by the accounts, apart from alot of signup emails being sent out and being blocked. I'll turn it back on when this campaign dies down.

@pfitzer cc #bpSpam

Hmm, blokowanie #bpSpam po domenach e-mail przestaje działać odkąd wykorzystują icloud.com czy proton.me albo gmail.com

Jak sobie radzicie? Jakieś pomysły poza wyszukiwaniem przez "bp%"?

Są jakieś pomysły na filtrowanie po klasach/adresach ip?

#AskFedi #FediTipsPL #FediPomoc #FediAdminPL

❗️ Spam accounts on #Mastodon #bpSpam

If you want to quickly select all accounts beginning with ‘bp’ in the admin panel (to suspend them), enter the following in the ‘Username’ field:

bp%

It’s also worth selecting ‘Active only’ under ‘Moderation’ in the form above to view newly registered accounts.

#FediMods #FediAdmin #Mastodon

❗️ Spam accounts on #Mastodon #bpSpam

If you want to quickly select all accounts beginning with ‘bp’ in the admin panel (to suspend them), enter the following in the ‘Username’ field:

bp%

It’s also worth selecting ‘Active only’ under ‘Moderation’ in the form above to view newly registered accounts.

#FediMods #FediAdmin #Mastodon

❗️ Spam accounts on #Mastodon #bpSpam

If you want to quickly select all accounts beginning with ‘bp’ in the admin panel (to suspend them), enter the following in the ‘Username’ field:

bp%

It’s also worth selecting ‘Active only’ under ‘Moderation’ in the form above to view newly registered accounts.

#FediMods #FediAdmin #Mastodon

❗️ Spam accounts on #Mastodon #bpSpam

If you want to quickly select all accounts beginning with ‘bp’ in the admin panel (to suspend them), enter the following in the ‘Username’ field:

bp%

It’s also worth selecting ‘Active only’ under ‘Moderation’ in the form above to view newly registered accounts.

#FediMods #FediAdmin #Mastodon

❗️ Spam accounts on #Mastodon #bpSpam

If you want to quickly select all accounts beginning with ‘bp’ in the admin panel (to suspend them), enter the following in the ‘Username’ field:

bp%

It’s also worth selecting ‘Active only’ under ‘Moderation’ in the form above to view newly registered accounts.

#FediMods #FediAdmin #Mastodon

❗ Spam-konta na #Mastodonie #bpSpam

Jeśli chcesz szybko zaznaczyć w adminie wszystkie konta zaczynające się od bp (by je zawiesić), wpisz w "Nazwa użytkownika":

bp%

Warto też w formatce wyżej zaznaczyć w "Moderacja" tylko aktywne, by zobaczyć nowo zarejestrowane.

#FediAdminPL #FediModsPL #FediAdmin #FediMods #FediPomoc

❗ Spam-konta na #Mastodonie #bpSpam

Jeśli chcesz szybko zaznaczyć w adminie wszystkie konta zaczynające się od bp (by je zawiesić), wpisz w "Nazwa użytkownika":

bp%

Warto też w formatce wyżej zaznaczyć w "Moderacja" tylko aktywne, by zobaczyć nowo zarejestrowane.

#FediAdminPL #FediModsPL #FediAdmin #FediMods #FediPomoc

❗ Spam-konta na #Mastodonie #bpSpam

Jeśli chcesz szybko zaznaczyć w adminie wszystkie konta zaczynające się od bp (by je zawiesić), wpisz w "Nazwa użytkownika":

bp%

Warto też w formatce wyżej zaznaczyć w "Moderacja" tylko aktywne, by zobaczyć nowo zarejestrowane.

#FediAdminPL #FediModsPL #FediAdmin #FediMods #FediPomoc

❗ Spam-konta na #Mastodonie #bpSpam

Jeśli chcesz szybko zaznaczyć w adminie wszystkie konta zaczynające się od bp (by je zawiesić), wpisz w "Nazwa użytkownika":

bp%

Warto też w formatce wyżej zaznaczyć w "Moderacja" tylko aktywne, by zobaczyć nowo zarejestrowane.

#FediAdminPL #FediModsPL #FediAdmin #FediMods #FediPomoc

❗ Spam-konta na #Mastodonie #bpSpam

Jeśli chcesz szybko zaznaczyć w adminie wszystkie konta zaczynające się od bp (by je zawiesić), wpisz w "Nazwa użytkownika":

bp%

Warto też w formatce wyżej zaznaczyć w "Moderacja" tylko aktywne, by zobaczyć nowo zarejestrowane.

#FediAdminPL #FediModsPL #FediAdmin #FediMods #FediPomoc

➡️ https://about.iftas.org/2026/09/11/boom-protocol-spam/

the page linked above will re-post tips, tricks, guidance to combat the #bpSpam wave impacting many service providers.

#BoomProtocol #BoomProtocolProbe #Spam #FediAdmin #MastoAdmin #PeerTubeAdmin #FediMods #Mastomods

➡️ https://about.iftas.org/2026/09/11/boom-protocol-spam/

the page linked above will re-post tips, tricks, guidance to combat the #bpSpam wave impacting many service providers.

#BoomProtocol #BoomProtocolProbe #Spam #FediAdmin #MastoAdmin #PeerTubeAdmin #FediMods #Mastomods

➡️ https://about.iftas.org/2026/09/11/boom-protocol-spam/

the page linked above will re-post tips, tricks, guidance to combat the #bpSpam wave impacting many service providers.

#BoomProtocol #BoomProtocolProbe #Spam #FediAdmin #MastoAdmin #PeerTubeAdmin #FediMods #Mastomods

➡️ https://about.iftas.org/2026/09/11/boom-protocol-spam/

the page linked above will re-post tips, tricks, guidance to combat the #bpSpam wave impacting many service providers.

#BoomProtocol #BoomProtocolProbe #Spam #FediAdmin #MastoAdmin #PeerTubeAdmin #FediMods #Mastomods

➡️ https://about.iftas.org/2026/09/11/boom-protocol-spam/

the page linked above will re-post tips, tricks, guidance to combat the #bpSpam wave impacting many service providers.

#BoomProtocol #BoomProtocolProbe #Spam #FediAdmin #MastoAdmin #PeerTubeAdmin #FediMods #Mastomods

“Boom Protocol” Spam

https://about.iftas.org/2026/09/11/boom-protocol-spam/

We just received about 60 (?) fake account registrations - this time not even trying to pretend any identities, just kind of DDoS.

What it interesting, that this time, they did not use known #TOR exit nodes and the IPs are not known by existing blacklists. Instead, the attack seemed to came from pool of IP addresses owned by Japanese companies and from Japanese mailservers...

We need to figure identity of operators of this botnet. Let's setup some place to share the IP addresses used by botnet. If we want to keep #Fediverse and #Mastodon registration open, we must federate our blocklists too...

CC @tante @iftas

#bpSpam

⚠️ #SW_ISAC_ADVISORY

Services continue to report a wave of #bpSpam account creation using the naming pattern "bp" followed by a series of random alphanumerics, eg "bpc7463204e397374e" or "bpde9af0166700f555".

To date almost all accounts are created using an email address at the domains:

docomo.ne.jp
ezweb.ne.jp

and to a lesser degree:

yahoo.co.jp
au.com

Requiring approval for accounts using these email domains during this attack will severely minimise your spam account review activity.