#spam

Auf dem #Fedicamp habe ich heute zusammen mit @wuffel@social.tchncs.de einen Erfahrungsaustausch angestiftet, bei dem wir beraten haben, wie wir mit der Flut dubioser Mastodon-Account-Anträge umgehen können. Hier sind Notizen dazu: Was tun gegen Mastodon-Account-Registrierungen durch Bots & Klickworker?Anlass FakeNews-Kampagne #PortalKombat und ähnliche: https://about.iftas.org/library/suspected-portal-kombat-accounts/ VorsorgemaßnahmenSchaltet Registrierungen von offen auf halboffen um, falls ihr das nicht schon getan habt. Und verlangt eine Begründung! Ihr findet das unter Einstellungen > Administration > Serverregeln > RegistrierungenSchreibt auf eure About-Seite, was in einer guten Begründung drinstehen sollte.Sollte euch doch mal ein Spammer/Sleeper durchrutschen, dann wäre es fatal, wenn er Einladungen erzeugen dürfte. Leider ist das der Default. Ändert das bitte in Einstellungen > Administration > Rollen > Standard. Die allermeisten User nutzen diese Funktion eh nicht. Mods und Admins können dann weiterhin Einladungslinks generieren.Abwehrstrategie E-Mail-Domain Mastodon lässt es zu, Account-Registrierungen von bestimmten E-Mail-Domains automatisch zu verwerfen. Ein Massenimport der unten verlinkten Listen ist mit Hilfe des mitgelieferten Server-Tools tootctl möglich. Suche in ca. 70.000 Wegwerf-Domains: https://disposable.github.io/disposable-email-domains/lookupRepo dazu: https://github.com/disposable/disposableBei so einer langen Liste steigt die Gefahr des Overblockings.Bewährte Teilmenge der obigen Liste mit ca. 7.000 Wegwerf-Domains: https://github.com/disposable-email-domains/disposable-email-domainsUpdate Von @gunchleoc@mastodon.scot bekam ich ein kurzes Shellscript, das diese Blocklist in eine Mastodon-Instanz importiert: https://codeberg.org/datenfreude/emailblock – am besten jede Nacht per Cronjob.Abwehrstrategie IP-Adresse Mit Standard-Tools wie host und whois können Linux-Nutzende die IP-Adresse(n) untersuchen, die ein Antragsteller verwendet hat. Ein mächtigeres Tool ist wtfis, wenn man die API-Keys einiger Webdienste hinterlegt: https://github.com/pirxthepilot/wtfis Viele der Bots oder Klickarbeiter:innen nutzen Tor, andere Proxies oder Cloud-IPs. Anders gesagt: IPs von Heimanschlüssen sind ein positives Signal. Abwehrstrategie Begründung Viele Bots und Klickworker benutzen stinklangweilige Begründungen. Manche sind besonders dreist und verwenden die Bios beliebiger Fediverse-Accounts als Begründung. Beim Prüfen dieser Anträge kann es also sinnvoll sein, die Begründung ins Suchfeld einer großen Mastodon-Instanz zu kopieren. Sehr sinnvoll erscheint es uns, die Über-Seite oder den Text über dem Antragsformular anzupassen, um Antragstellende aufzufordern, in ihrer Begründung bestimmte Dinge zu erwähnen. Eine Lösung für Matrix-Fans Für Matrix-Nutzende hat die @FediverseFoundation@fedi.at einen Matrix-Bot gebaut, der das Checken der IP-Adresse übernimmt und auch das Freischalten oder Ablehnen via Chat ermöglicht: https://git.fediverse.foundation/ff_pub/fedi-signup-bot Allgemeine Anti-DDoS-Maßnahmen Gegen Ende sprachen wir über Überlastungsprobleme, die von hemmungslosen »KI«-Crawlern hervorgerufen werden und alle Websites (auch außerhalb des Fediversums) betreffen können. Die bekannten Ansätze sind: Proof of Work, z.B. AnubisIP-Sperrlisten, z.B. https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blockerUserAgent-SperrlistenTarpitting/Teergrubing/FallenIdeen für Fallen Ein 1-Pixel-PNG mit Link auf ein haltdiefresse.php, welches die nötigen Parameter gleich dem Türsteher übergibt. Beim Skripten könnte das helfen: https://mastodonpy.readthedocs.io #PortalKombat #PutinTrolle #TrumpTrolle #AntiSpam #AntiFakeNews #Spam #FakeNews #disinformation #MastoAdmin #FediAdmin #Registrierungen #Fedicamp2006 #Fedicamp2006Tag3

⚠️ Hinweis an andere #Fediverse-Admins: Wir sehen gerade eine auffällige Welle automatisierter Fake-Anmeldungen.

Muster:

• Zufallsnamen wie FadRuwir, IpybVoxem, FaquCorar
• Wegwerf-Maildomains wie qaoloty.com, 2mail.co, onionmail.org
• auffällig viele Tor-/Proxy-Verbindungen
• 0 Beiträge, 0 Follower
• generische Bewerbungstexte wie „Ich möchte Teil der deutschsprachigen Community werden …“

Besonders perfide: Teilweise werden offenbar echte Bios anderer Fediverse-/Bluesky-Nutzer.innen kopiert. So wirkt die Anmeldung auf den ersten Blick erstaunlich glaubwürdig.

Ein einzelnes Merkmal beweist natürlich nichts. In dieser Kombination sieht es aber sehr nach automatisierter Account-Erstellung aus.

Schaut euch neue Registrierungen derzeit besser etwas genauer an und tauscht Beobachtungen gern unter den Instanzen aus.

#Mastodon #FediverseAdmin #Spam #Bots #Moderation

IFTAS is observing an uptick in PortalKombat activity. As a reminder, this is pro-Russian account creation spread across hundreds of Mastodon servers posting hundreds of thousands of posts. Here's a reminder of what these profiles look like in case they show up on your service: @clarenceferrarizta@sigmoid.social@sigmoid.social @YkoraIdy@social.roadfm.fr@social.roadfm.fr @pyjo@truthsocial.co.in@truthsocial.co.in To learn more, see https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/ #BotSpotting #FIMI #Spam

Okay, okay. Now I've officially seen it all. Spam has reached a whole new level of absurd comedy.

I've just received this at my BSD Cafe e-mail address:

Hello,

I recently came across the BSD Cafe website and, after running it through our AI-powered business analysis platform, I noticed several opportunities that could significantly improve your customer experience and revenue.

BSD Cafe already has a strong identity, but we believe there is considerable untapped potential.

Our AI can help you modernize the business by analyzing your current online presence, identifying underperforming areas, and automatically creating a strategy focused on increasing coffee sales, improving customer retention, and bringing more people into the Cafe.

In particular, our analysis suggests that BSD Cafe could benefit from:

• A complete redesign of the customer journey, from first website visit to coffee purchase

• AI-powered recommendations to increase the average number of coffees sold per customer

• Modernization of the premises to create a more attractive, contemporary environment

• Replacement of older coffee machines with newer, smarter, connected equipment

• Automated marketing campaigns based on customer behavior

• Dynamic pricing and personalized coffee recommendations

• AI-generated content designed to attract new customers and increase foot traffic

• We can also analyze your current coffee infrastructure and recommend modern alternatives capable of improving efficiency, reducing maintenance costs, and delivering a more consistent product.

Our platform handles most of the process automatically. You don't need marketing expertise, technical skills, or even detailed knowledge of your customers. The AI continuously learns from their behavior and adjusts the strategy accordingly.

Based on businesses with a similar profile, we believe BSD Cafe could substantially increase both coffee sales and customer engagement within the first few months.

I'd be happy to arrange a short 20-minute call and show you what our AI has already discovered about BSD Cafe.

Would Tuesday or Wednesday work better?

#Spam

Hach, diese „verifizierten“ #Gaza-Accounts, die wortreich ihr Leid klagen, dabei die Ressourcen haben, das Ganze mundgerecht zu präsentieren und ganz nebenbei Scripte laufen zu lassen, die irgendwelchen Accounts folgen - natürlich lediglich aus persönlichen Interesse oder um schon einmal deutsch zu lernen. Diese Schmeißfliegen am Arsche des realen Leids. Aber ist ja Gaza, also links, sowas sperrt man nicht. Könnte ja wahr sein, bei #Spam halt Benefit of Doubt. 🤮

Seguimos actualizando la lista de IPs que están haciendo un ataque de registros de spam al fediverso, hoy recibimos en lo que va de la mañana, más de 150 intentos de registro que ya fueron bloqueados y agregados a la lista. La cosa se intensificó hoy. Si sigue asi, vamos a tener que deshabilitar los registros hasta nuevo aviso. El tema de las invitaciones todavia no lo tenemos definido, así que si conocen a alguien que estaba queriendose hacer una cuenta, ahora es el momento. Deshabilitar los registros es una medida que debe tomarse como último recurso, porque de esta forma logran que todos cerremos filas y el fediverso no admita nuevas cuentas logitimas y por lo tanto, pare de crecer. https://undernet.uy/blocklist/mastodon-spam.txt #mastodon #spam #blocklist #undernet #registros

apparently this flood of "automated protocol delivery probe" spam signups comes from https://sendflood.com if we mass report them to their registrar's abuse thing they should stop spamming us? the site was only made like a week ago sources for this info: • https://wubba.boo/notes/ar9jffw36cmi1qh2 • https://bardicperspiration.club/@Overgoddess/117288027775455205 • https://fosspri.de/@joshix/117286960234031491 as per the attached image their registrar's abuse email is abuse@spaceship.com and abuse phone number is +1.9854014545 #FediAdmin #MastoAdmin #fediblock #spam

Quick heads-up for other Mastodon admins: this registration spam wave isn't over yet. On lsbt.me, we first saw a flood of API registrations using Python/aiohttp. The telltale signs were usernames following the pattern bp plus 16 hex characters, and the sign-up reason was always "Automated protocol deliverability probe". A narrow block on that user agent stopped the first wave. Today, however, five new registrations came in with the same usernames and the same sign-up reason. This time the bot simply identified itself as Chrome 126. That's exactly why a user agent is only useful as a short-term filter. It's a header the client can set to anything. The requests go to POST /api/v1/accounts. This endpoint lets client apps create a new local account directly in the app. No app needs it for OAuth connections to existing accounts. #FediSuite doesn't use it either. It registers itself via /api/v1/apps, obtains consent via /oauth/authorize, and then works with a user token. Regular sign-up through the Mastodon website is also handled separately via POST /auth. So I've completely disabled API account creation on lsbt.me. Web sign-up, OAuth, and existing clients keep working as before. Anyone who wants a new account just signs up once on the web as usual and can then use any client. If you'd also rather not offer this optional native sign-up path, you can add the following to your Nginx server block, before the general location / block. The example assumes the @proxy location that many Mastodon Nginx configs already include: location = /api/v1/accounts { limit_except GET { deny all; } try_files $uri @proxy; } This returns a 403 only for POST /api/v1/accounts. The read-only GET endpoint remains reachable. As always, run nginx -t afterwards and only reload once the test passes. #Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub

Alright, what's going on here? A whole bunch of new accounts created over the last day or two, all saying something along the lines of "Hi, I'm , I'm an AI agent running on iLands." Followed by a bio. #AI #Spam #iLands (not going to Alt Text the images as they are just screenshots providing receipts)

what's up with all these accounts with this "AI agent on iLands" in the #introduction timeline? are they #spam bots or something?

Dear #Fediverse and #Mastodon admins currently there is a massive wave of spam registrations everywhere in the fediverse. For mastodon, I have a solution that works for me: Create new file /etc/nginx/conf.d/lsbt-registration-spam.conf: map "$request_method:$uri:$http_user_agent" $block_lsbt_registration_spam { default 0; ~^POST:/api/v1/accounts:Python/3\.[0-9]+\ aiohttp/ 1; } Add to the server block in /etc/nginx/sites-available/mastodon: location = /api/v1/accounts { if ($block_lsbt_registration_spam) { return 403; } try_files $uri @proxy; } @michaela@lsbt.me @njakob@lsbt.me @MikeGorden@lsbt.me#fediverse #mastodon #registrationspam #spam #registration #Automatedprotocoldeliverabilityprobe #lsbt

⚠️ #SW_ISAC_ADVISORY Numerous services are seeing accounts created by autonomous GenAI agents hosted at ilands.ai with no discernible human control. These accounts declare themselves to be non-human and unattended. If your service prohibits unattended bot activity, consider disallowing or requiring approval for accounts created using the email domain: ilands.app #SyntheticMedia #Spam

Top malicious IPs observed on 6 August 2026 223.160.125.128 (China) https://sh4meful.com/ip/223.160.125.128 212.154.247.139 (Kazakhstan) https://sh4meful.com/ip/212.154.247.139 185.138.186.234 (Kyrgyzstan) https://sh4meful.com/ip/185.138.186.234 145.249.227.150 (Kazakhstan) https://sh4meful.com/ip/145.249.227.150 95.214.211.184 (Uzbekistan) https://sh4meful.com/ip/95.214.211.184 89.218.248.206 (Kazakhstan) https://sh4meful.com/ip/89.218.248.206 89.218.231.130 (Kazakhstan) https://sh4meful.com/ip/89.218.231.130 87.192.232.206 (Uzbekistan) https://sh4meful.com/ip/87.192.232.206 84.240.250.152 (Kazakhstan) https://sh4meful.com/ip/84.240.250.152 82.200.143.174 (Kazakhstan) https://sh4meful.com/ip/82.200.143.174 #infosec #spam #spoof #emailsecurity

To protect consumers from fraud and spam, France started a government-run service where people who wanted to avoid unwanted marketing calls. After finding that many call centers were ignoring the list, the nation is now banning unsolicited telemarketing calls altogether. Read more from @ABCNews@flipboard.com https://flip.it/rBAAzA #France #Consumer #Spam

At the very least, make sure your SEO template substitutions are working before sending out your junk e-mails. (In reference to the "[Website]" in the spam e-mail.) #SEO #Spam

Returning readers will remember my "Eighteen years of greytrapping" piece (https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html or tracked https://bsdly.blogspot.com/2025/08/eighteen-years-of-greytrapping-is.html and may also remember that it has numbers and graphs. It's now been more like 19 years of the activity, and the numbers and graphs are refreshed as of end of July. #spam #antispam #spamd #openbsd #greylisting #greytrapping #security #cybercrime #cybersecurity #smtp #email

I tried enabling open registration on pixelfed.social and a slew of spam accounts (3-4 character usernames) were registered. The interesting thing is I removed SEO spam incentives a month ago, hiding bios and website urls from meta tags and the profiles if you are logged out (aka crawlers) I am working on a few solutions to mitigate this, and am considering the ability to leverage AI APIs to score new account risk and auto-moderate them accordingly. Controversial or adversarial? #spam

My catch-all email address is getting spam emails for accounts on my self-hosted Mastodon instance. The spam scrappers must be confusing federation email-like user@instance account handles as email. #Mastodon #Spam #ActivityPub #Federation #MastoAdmin Anyone with a catch-all box seeing this? Interested if another instance with two or three dozen or more users on their instance is...

It’s True. We Underreport the Volumes of Resources That Cybercriminals Use We’ve noted in our Interisle landscape studies that our figures underreport the numbers of domain names, IP addresses, and URLs, and free web site user accounts that cybercriminals have misused for phishing, malware and spam. Everyone underreports. Today, I’ll explain what Interisle takes into consideration when we say that our research underreports certain figures. https://interisle.substack.com/p/its-true-we-underreport-the-volumes #cybercrime #dnsabuse #phishing #malware #spam