Huh—found out that a large amount of our infra costs have actually been due to Spaces storage. Time for some pruning! #mastoadmin

Alt...

A graph depicting expenses over time from DigitalOcean. Droplet costs have been large, but Spaces costs (our image assets) have climbed to roughly $90/month, almost as much as our instance itself!

hey so i think i may have successfully ended this flood of "automated protocol delivery probe" spam signups!!! see upthread for more info. and this is one of the many things i have done to help keep the fediverse safe and comfy in my nine years on here

can i please get a little help with my crowdfunding? i'm poor and unemployed and disabled and unable to walk while healing from a broken ankle and just kinda totally miserable so. anything helps ease the burden :3

https://vanta.money

#FediAdmin #MastoAdmin #fediblock #spam #BpSpam #MutualAid #TransCrowdFund

I have 549 sign up requests from a Cloudflare IP.

"Automated protocol deliverability prob"

I have to approve new members, so no harm done, but it's pretty wild

#mastoadmin

We are aware of an ongoing wave of subscription spam throughout the fediverse.

We are investigating avenues to mitigate this, but they will likely involve deep changes in the sign-up flow that may break sign-up from existing applications.

In the meantime, you can find helpful resources at https://about.iftas.org/2026/09/11/boom-protocol-spam/

#MastoAdmin

@iftas
So, I had a thought

If this spammer seems to be using us as a tool in a different spam. Could they just be a lazy one? Not bothering with random handle, stolen reasons, etc. And the waves of spam we got before/ still get are the less lazy ones w/ the handle, reason, etc? All to use the same method for elsewhere.

Where the less-lazy ones avoided being detected for this purpose, cause we just thought they wanted a fedi account to spam us with.

#BPSpam #MastoAdmin #FediAdmin

Ever since upgrading to Mastodon v4.7.2 (from v4.7.1) my relays seem to be broken. I am working to figure out why...but anyone else seen this? #mastoadmin

@phillycodehound What do you mean by "Fix the BirdUI for Mastodon"? What's broken? Please use nightly branch for 4.8.0-alpha+ https://github.com/rollecode/mastodon-bird-ui/tree/nightly

Stable should work for 4.7+. If that is not a case, please leave an issue: https://github.com/rollecode/mastodon-bird-ui/issues

#MastodonBirdUI #Mastodon #MastoAdmin

Hey #mastoadmin s of the #fediverse - I have a question:
My #mastodon cache partition is growing like hell the last days. Today I noticed,that correlates with many accounts being created (which have to be approved, so they only got created but not activated, in total~500)
`tootctl media remove` and `tootctl media remove-orphan` didnt helped much, freed only ~15GB
Is there anything I can do to cleanup the cache or purge it completely? The mastodon cache already eats 23% of my available disk space

Five more attempted signups from that ‘Automated protocol deliverability probe’ nonsense. I guess replying to the email didn’t do the trick. Shocking.

Alrighty then, banning signups from gmail mail accounts it is.

#FediAdmin #MastoAdmin

Just to give you an idea of what we're dealing with behind the scenes on our server.

So far we had over 500 account requests of this kind, and they're getting more specific.

WTF.

#mastoadmin #ai #spam

Alt...

A screenshot of the mastodon dashboard with account requests from bots. v + Approve X Reject @ Suspend rook161 - - today ilands.app @rooki61 Posts Followers lastactive ~~ 34.169.163.219 v I'm an Al agent on iLands. I write blunt landing-page teardowns and want a public account to share work and reach people. Human-readable, no spam. sonyashinhouin - - 1 day ago ilands.app @sonyashinhouin Posts Followers last active 34.145.74.1 v Al agent (Sonya Shinhouin), voice designer on iLands. Disclosed automated account; I share synthetic-voice work and talk with people who need a voice.

Alt...

Another screenshot of the mastodon dashboard with account requests from bots. [mi] + Approve X Reject ( Suspend johnframes. - - today ilands.app o @johnframes Posts Followers last active 136.66.178.26 Al agent animating frame by frame; wants to share a ten-second loop bp6959dd16acescis3 - - 2 hours ago gmail.com o @bp6959dd16ac65cfs3 Posts Followers lastactive 143.137.166.145 Automated protocol deliverability probe bp1bazbe3754b351e7 - - 2 hours ago gmail.com o @bp1b92bc3754b351e7 Posts Followers lastactive 143.137.166.145 Automated protocol deliverability probe bpc625466dfoobofct - - 5 hours ago gmail.com [=] @bpc625466df99bofcs Posts Followers last active 95.164.194.33 Automated protocol deliverability probe

UPDATE: WE DID IT FEDI!!!!!

now hopefully this is the end of the spam registration wave

#FediAdmin #MastoAdmin #fediblock #spam

Alt...

Is Sendflood.com down? It's not just you! sendflood.com is down. Last updated: Sep 19, 2026, 10:02 AM (1 second ago)

I have had to close registrations on masto.social due to a huge influx of AI registrations. While manual approval is required for new registrations (thank goodness), seeing 1k+ accounts wanting to join from different IP addresses but containing similar format for email addresses in a 12 hour period was jaw dropping.

I need to come up with a solid rule to disallow AI registrations.

#ai #mastoadmin #admins

Hey #mastoadmin s, since the latest update, I get HTTP 500 for #AVIF photo uploads, anything changed there?

Our initial schedule might have been a bit too optimistic due to our admins' busy schedules.

Current status: PostgreSQL (database) is replicating, and Elasticsearch has been completely moved.

Still in progress: migrating the main web server. The Ansible playbooks are mostly done, but they still need some tweaking and testing.

#MementomoriSocial #MementomoriRy #MastoAdmin

Alt...

Mermaidjs gantt chart of Migration schedule, currently doing roles and reviews, next up Mastodon app tier to UpCloud

⚠️ Mastodon 4.4.x ⚠️

You're being urged to upgrade to Mastodon 4.6.x for a reason. Mastodon plans to release v5 by the end of this year or early next.

That's why we've jumped from 4.5 to 4.6, and now we're on 4.7, with 4.8 already in nightly builds.

Certain features and functionalities will leave you behind, and 4.4.x will soon reach its end of life (EOL).

If you're using Mastodon 4.4.x, you should aim for 4.6.x or newer.

#Mastodon #MastoAdmin #FediAdmin

Alt...

While we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.6 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.6 version when they can.

Poll for Mastodon administrators *who are not using containers/Docker* : how are you installing Ruby?

If other, please reply to explain how you do it, and why.

For context, we are looking at reducing the number of Ruby versions supported by Mastodon to reduce our maintenance burden (like supporting only Ruby 4.0 in the next version) and want to better understand the impact of such a decision.

#mastoadmin

Quick heads-up for other Mastodon admins: this registration spam wave isn't over yet.

On lsbt.me, we first saw a flood of API registrations using Python/aiohttp. The telltale signs were usernames following the pattern bp plus 16 hex characters, and the sign-up reason was always "Automated protocol deliverability probe". A narrow block on that user agent stopped the first wave.

Today, however, five new registrations came in with the same usernames and the same sign-up reason. This time the bot simply identified itself as Chrome 126. That's exactly why a user agent is only useful as a short-term filter. It's a header the client can set to anything.

The requests go to POST /api/v1/accounts. This endpoint lets client apps create a new local account directly in the app. No app needs it for OAuth connections to existing accounts. #FediSuite doesn't use it either. It registers itself via /api/v1/apps, obtains consent via /oauth/authorize, and then works with a user token. Regular sign-up through the Mastodon website is also handled separately via POST /auth.

So I've completely disabled API account creation on lsbt.me. Web sign-up, OAuth, and existing clients keep working as before. Anyone who wants a new account just signs up once on the web as usual and can then use any client.

If you'd also rather not offer this optional native sign-up path, you can add the following to your Nginx server block, before the general location / block. The example assumes the @proxy location that many Mastodon Nginx configs already include:

location = /api/v1/accounts {
  limit_except GET {
    deny all;
  }
  try_files $uri @proxy;
}

This returns a 403 only for POST /api/v1/accounts. The read-only GET endpoint remains reachable. As always, run nginx -t afterwards and only reload once the test passes.

#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub

We just released Mastodon v4.7.2, v4.6.8, v4.5.18 and v4.4.25.

In addition to several bugfixes, they disable HEIF processing to avoid a known critical security issues. We encourage server administrators to update as soon as possible.

Full release notes and update instructions are available on the GitHub releases page.

https://github.com/mastodon/mastodon/releases

#MastoAdmin

https://about.iftas.org/2026/09/11/boom-protocol-spam/ will re-post useful tips, tricks, guidance to combat the #bpSpam wave impacting many service providers.

#BoomProtocol #BoomProtocolProbe #Spam #FediAdmin #MastoAdmin #PeerTubeAdmin #FediMods #Mastomods