Conversation

Notices

1. seb (seb@ioc.exchange)'s status on Sunday, 12-Apr-2020 12:38:20 CEST seb

   Remote profile options...

   • The_Gibson
   • Stanislas
   • Andrew (R.S Admin)
   • sαη∂εя✨
   • T-t-t-t-tek Headroom

   @thegibson @tek @ajroach42 @angristan @snder I'm seeing clusters of IP addresses from Russia registering bots at a rate of 1/hour on my two instances. Looks to me that someone is preparing to influence the Fediverse.

   Do you see the same?

   #mastoadmin

   • tuttle (tuttle@santsenques.cat)'s status on Sunday, 12-Apr-2020 12:38:17 CEST tuttle

     Remote profile options...

     in reply to

     • admin de gnusocial.net
     • tuttle
     • fanta
     • admins_del_fediverso group
     @administrator @fanta @seb Aventuro decir que ya es insostenible https://pad.lleialtat.cat/p/dominiosbots @admins_del_fediverso
     admins_del_fediverso group repeated this.
   • tuttle (tuttle@santsenques.cat)'s status on Sunday, 12-Apr-2020 12:38:18 CEST tuttle

     Remote profile options...

     in reply to

     • admin de gnusocial.net
     • fanta
     @administrator @fanta @seb Esto llegará a ser insostenible.
   • seb (seb@ioc.exchange)'s status on Sunday, 12-Apr-2020 12:38:19 CEST seb

     Remote profile options...

     in reply to

     • The_Gibson
     • Stanislas
     • Andrew (R.S Admin)
     • sαη∂εя✨
     • T-t-t-t-tek Headroom
     • Tom "Emuz"​:e1:​Rinaldo :vfmt:

     @emuz @thegibson @tek @ajroach42 @angristan @snder

     I started two lists that I will maintain - Happy to add anyone's IOCs to it. Also ran the IPs and domains through some threat intel tools - Seems to be anonymizing infrastructure mainly. Also, the sheer size of the infrastructure (incl. all the mx records of the domains etc.) makes me believe this actor is doing this professionally.

     https://ioc.tips/lists/(dat://2221485f692c7ffdb6f449838a168aec110152ca33ca79e57285372ea43ee340/lists/)

   • admin de gnusocial.net (administrator@gnusocial.net)'s status on Sunday, 12-Apr-2020 12:38:19 CEST admin de gnusocial.net

     Remote profile options...

     in reply to

     • tuttle
     • fanta
     @seb@iox.exchange @fanta @tuttle @admins_del_fediverso@gup.pe have a quite long list: https://pad.lleialtat.cat/p/dominiosbots
   • Tom "Emuz"​:e1:​Rinaldo :vfmt: (emuz@kafuka.me)'s status on Sunday, 12-Apr-2020 12:38:20 CEST Tom "Emuz"​:e1:​Rinaldo :vfmt:

     Remote profile options...

     in reply to

     • The_Gibson
     • Stanislas
     • Andrew (R.S Admin)
     • sαη∂εя✨
     • T-t-t-t-tek Headroom

     @seb @thegibson @tek @ajroach42 @angristan @snder Kafuka.ME has also been subjected to the same attack. One I noticed that wasn't on your list was attacks from 77.220.192.72. I've been playing wack-a-mole all day with the pending requests. I've been adjusting firewalls and harding as I go, but if we have a known bad actors list or an automatic system that would make things a bit easier as things happen..

   • spla (spla@mastodont.cat)'s status on Sunday, 12-Apr-2020 12:41:36 CEST spla

     Remote profile options...

     in reply to

     • admin de gnusocial.net
     • tuttle
     • fanta
     • admins_del_fediverso group

     aconsejo configurar el registro en modo "requiere aprobación". Lo tengo así y hoy sólo se ha querido registrar uno que he rechazado.@tuttle @administrator @admins_del_fediverso @seb @fanta

     admins_del_fediverso group and admin de gnusocial.net repeated this.
   • seb (seb@ioc.exchange)'s status on Sunday, 12-Apr-2020 18:13:47 CEST seb

     Remote profile options...

     in reply to

     • admin de gnusocial.net
     • tuttle
     • fanta
     • admins_del_fediverso group

     @tuttle @administrator @admins_del_fediverso @fanta Thank you!

     admins_del_fediverso group repeated this.