#mastoadmin — Public Fediverse posts

1,591 accounts identified as participating in spam and scam activity — along with accounts that actively promote, defend, or amplify them.

Save as a CSV file, for example, block.csv, import (upload) the file, and merge it with your current block list.

https://gitlab.com/Fediverse-Express/Fediverse/-/blob/main/block_spam_scam_users.csv?ref_type=heads&plain=1

This post should be self-explanatory, but for a more exhaustive outline, see: https://fairy.id/@Linux/117385319051532229

#Spam #Scam #Fraud #FediBlock #FediAdmin #MastoAdmin #Mastodon #Misskey #Fediverse #ActivityPub #IsraelVerified #GazaVerified

Hey everyone!

We had to defederate mstdn.jp due to a massive wave of spambots from their server, pinging users with proxied google-like links (beware!)

#TheGamersTavern #Mastodon #MastoAdmin

In the past 24 hours, my firewall has stopped 172 malicious or spam account creations on this Mastodon server and 34 on my Mobilizon server.

Four humans got through the firewall and opened accounts here, one on Mobilizon.

Can you believe how bad it has gotten?

I keep registration open when I'm sitting here watching on my other screen, so if any succeed, I investigate how they bypassed the rules and I get rid of them.

Here are the worst offenders:

172.94.9.60 (Limited Network LTD - Netherlands): Hitting GET /auth/sign_up repeatedly across the entire log (17:50, 18:01, 20:10, 20:23, 21:21, 21:53, 00:38, 00:48).

176.72.95.127 (Telia Finland Oyj): Hitting GET /auth/sign_up on its mechanical polling schedule (14:40, 17:35, 17:43, 23:28, 01:34, 03:01).

2a01:5ec0:... (Iran Cell): Firing rapid double-bursts directly into /auth/sign_up.

The Limited Network Dutch Bot Flood (172.94.9.60): Volume: Over 35 distinct POST requests.

Cadence: Machine-gun bursts within milliseconds of each other:
- Six hits in the exact same second at 20:10:50Z
- Four hits in the exact same second at 20:23:55Z
- Five hits in the exact same second at 17:42:06Z

Protocol & Fingerprint: Firing dozens of raw HTTP/1.1 while claiming to be desktop Chrome 124 on Linux.

The Tor Mail-Bomb Swarm:

185.220.100.248 (F3 Netze e.V., Germany): Claiming to be Chrome/38 on Linux i686 over HTTP/1.1.

171.25.193.82 (DFRI, Sweden): Claiming to be Chrome/39 on Mac OS X 10_8_1 (Mountain Lion, from 2012).

185.150.28.13 (FSIT AG, Switzerland): Claiming to be Chrome/37 on Linux x86_64.

45.66.35.38 (SABOTAGE LLC): Claiming to be an iPhone on iOS 9.3.1 (from 2016).

#Mastoadmin #bot #IFTAS

Thanks to everyone’s feedback I’m currently testing bunny.net with my fname.ca domain.

Onboarding wasn’t super-difficult, there were a few differences with terminology but overall it was fairly intuitive. They offer a 14-day trial that doesn’t require a credit card, so I’m hoping to get a feel for traffic/cost in that time.

#MastoAdmin #AskFedi #SelfHosting

Heads up looks like there is a new bot spamming through multiple Mastodon servers and trying to send what looks like a phishing link. #Fediblock #Cybersecurity #Phishing #Mastodon #MastoAdmin