Poll for Mastodon administrators *who are not using containers/Docker* : how are you installing Ruby?

If other, please reply to explain how you do it, and why.

For context, we are looking at reducing the number of Ruby versions supported by Mastodon to reduce our maintenance burden (like supporting only Ruby 4.0 in the next version) and want to better understand the impact of such a decision.

#mastoadmin

1,259 accounts identified as participating in spam and scam activity — along with accounts that actively promote, defend, or amplify them.

Removing the harmful AI accounts, spam users, and scammers really does make the Fedi seem better.

https://github.com/Fediverse-Express/Fediverse/blob/main/block_spam_scam_users.csv

#AI #ArtificialIntelligence #MastoAdmin #FediAdmin #FediBlock #Spam #Bot

@christin for those sensible people that use Caddy, here's the config snippet for that:

```
@apiacct {
path /api/v1/accounts
not method GET
}

handle @apiacct {
respond "Go stick your head in a pig" 403
}
```

#mastodon #fediverse #mastoadmin

Since others are seeing issues with the #bpSpam I pushed my changes to my gitea instance.

https://repo.anhonesthost.net/jknapp/mastodon-altcha-captcha

#mastoadmin #fediblock

I see the bots are back in force today...

Just deleted 20-25 bots trying to sign-in on SDF. All of them coming from gmail.

Fix your sh!+ Google. Seriously, this is spam, pure and simple.

#mastodonmoderation
#Moderation
#MastoAdmin

Alt...

A long list of bots, all starting with 'bp' with names looking like SHA checksums, and all having an email address on gmail

apparently this flood of "automated protocol delivery probe" spam signups comes from https://sendflood.com

if we mass report them to their registrar's abuse thing they should stop spamming us? the site was only made like a week ago

sources for this info:

• https://wubba.boo/notes/ar9jffw36cmi1qh2

• https://bardicperspiration.club/@Overgoddess/117288027775455205

• https://fosspri.de/@joshix/117286960234031491

as per the attached image their registrar's abuse email is abuse@spaceship.com and abuse phone number is +1.9854014545

#FediAdmin #MastoAdmin #fediblock #spam

Alt...

Domain Information Domain: sendflood.com Registered On: 2026-09-08 Expires On: 2027-09-08 Updated On: 2026-09-08 Status: client transfer prohibited Name Servers: launch1.spaceship.net launch2.spaceship.net Registrar Information Registrar: Spaceship, Inc. IANA ID: 3862 Email: support@spaceship.com Abuse Email: abuse@spaceship.com Abuse Phone: +1.9854014545

Has anyone worked out what the “Automated protocol deliverability probe” spam wave is about? Do we know who’s doing it or what their goals are?

#MastoAdmin

We have been getting bombarded with spam sign-ups lately from a botnet. Hundreds of them, same pattern every time: random hex username, gmail addresses reusing the same inbox with +tags, different IP on literally every request. Classic rotating-proxy spam farm hitting every instance it can find.

I thought they were filling out the form for sign up (since we did not have a captcha in place), but they were hitting the API endpoints pretty rapidly. Turns out third-party apps have their own registration flow separate from the website, and that's the path they were actually using. Which is why nothing I did to the sign-up page seemed to slow them down at first.

The fix ended up being both blocking the API sign-up AND adding a captcha to the form.

We already require manual approval on new accounts, so none of this actually went live, it was just clogging the queue and annoying me.

Learn from my mistake, check the logs before trying to form a solution.

#mastoadmin #fediblock

25 domains are running Fediverse software that has either been disconnected, reached end-of-life, or is well over a year old with known security concerns.

Naturally, all admins were contacted well in advance before being added to the list.

I actually messaged 127 admins. 102 of them thanked me for letting them know and upgraded.

https://github.com/Fediverse-Express/Fediverse/blob/main/security_risk_domains.csv

#MastoAdmin #FediAdmin #Mastodon #Misskey #Firefish

25 domains using Fedi software that has either been disconnected, end of life, are is well over a year old with known security concerns.

Naturally, all admin were contacted well in advance before being added on the list.

I actually messaged 127 admins. 102 of them all thanked me for letting them know, and upgraded.

https://github.com/Fediverse-Express/Fediverse/blob/main/security_risk_domains.csv

#MastoAdmin #FediAdmin #Mastodon #Misskey #Firefish

Vom 10. bis 17.9. wurden auf troet.fediverse.at 340 Konten angelegt, 337 davon mit generierten Namen nach dem Muster »bp« + 16 Hex-Zeichen. Jede Anmeldung von einer eigenen IP, null Beiträge, null Bestätigungen.

Das Ziel waren nicht die Konten, sondern die Bestätigungsmails: Mein Server hat sie an fremde Adressen verschickt, überwiegend japanische Provider. Google hatte einen der Empfänger schon gedrosselt, die Bounces landeten bei mir.

Das Ärgerliche daran: Mastodons Bordmittel greifen alle zu spät. hCaptcha hängt im Bestätigungsschritt, also nach dem Mailversand. Genehmigungspflicht ebenso. IP- und Domainsperren sind bei einer IP pro Anmeldung und echten Opferadressen sinnlos.

Meine Lösung mangels Alternative: Registrierung abgedreht – niemand kann sich mehr neu registrieren. Nicht gut auf Dauer! Die 337 Konten gelöscht, ohne E-Mail-Blockierung — sonst sperrt man die Opfer aus statt der Täter.

Hat jemand eine bessere Idee? Etwa eine Challenge vor /auth/sign_up im Reverse Proxy?

#Mastodon #MastoAdmin #Fediverse #Spam #SysAdmin #SelfHosting

Mastodon updated to v4.7.2, a critical security update. Is anyone else surprised that you don't have to run the bundle / yarn / RAILS_ENV steps in the last few patches? A happy surprise for me!

https://github.com/mastodon/mastodon/releases/tag/v4.7.2

#MastoAdmin

The above also works on the PeerTube-Database. Just replace

IF NEW."registrationReason" = 'Automated protocol deliverability probe' THEN

and

BEFORE INSERT ON "userRegistration"

#MastoAdmin #PeerTube #BoomProtocolProbe #AutomatedProtocolDeliverabilityProbe

Hey #mstdnca folks, over the last four months or so, TekSavvy's service has significantly degraded, with the service dropping out two to three times daily.

This is not acceptable. I understand Rogers owns the lines. A Rogers tech was sent out on a day I said I specifically wasn't home, but they never offered a replacement date.

I've chosen to cancel the service this morning as they are not, have have not made sufficient effort to rectify the problem. I am not seeking CCTS resolution, as I feel all Canadians should be able to access internet outside of what is now the Big 2, and I don't want the CRTC to impose a penalty that would hinder TekSavvy in any some small way.

We are looking at alternative cable resellers, but until then, we can still fail over to our third (now second) service provider, so we're not beholden to one provider.

I wanted to share this update - and the appropriate logs - with everyone, as I feel it's important that we are transparent with the community.

#mstdnca #mastoadmin

Alt...

INTERNET + TV + PHONE Cancellation Notification Hello CHAD OHMAN, We're writing to confirm that we have received your request to cancel our service. Your account , has been updated accordingly, and the cancellation will take effect as of 9/17/2026. Services Requested to be Cancelled: Internet Service Details: Package: Cable 100 Unlimited / Cable 100 lllimité Service Address: EDMONTON OID: TV Service Details: Package: Basic West Service Address: ,. EDMONTON OID:

Kurzer Hinweis an andere Mastodon-Admins: Diese Registrierungs-Spam-Welle ist noch nicht überstanden.

Bei lsbt.me kamen zunächst massenhaft API-Registrierungen mit Python/aiohttp rein. Auffällig waren Nutzernamen nach dem Muster bp plus 16 Hex-Zeichen und als Antragstext immer Automated protocol deliverability probe. Eine enge Sperre auf diesen User-Agent hat die erste Welle gestoppt.

Heute kamen trotzdem fünf neue Registrierungen mit denselben Nutzernamen und demselben Antragstext. Der Bot gab sich diesmal einfach als Chrome 126 aus. Genau deshalb taugt ein User-Agent nur als kurzfristiger Filter. Er ist ein frei wählbarer Header.

Die Requests laufen über POST /api/v1/accounts. Dieser Endpoint erlaubt Client-Apps, einen neuen lokalen Account direkt in der App anzulegen. Für OAuth-Verbindungen bestehender Accounts braucht ihn keine App. Auch #FediSuite nutzt ihn nicht. Sie registriert sich über /api/v1/apps, holt die Zustimmung über /oauth/authorize und arbeitet danach mit einem User-Token. Die normale Registrierung über die Mastodon-Webseite läuft ebenfalls getrennt über POST /auth.

Ich habe die API-Kontoerstellung auf lsbt.me deshalb komplett abgeschaltet. Webregistrierung, OAuth und bestehende Clients laufen unverändert weiter. Wer einen neuen Account möchte, registriert sich einmal ganz normal wie bisher im Web und kann danach jeden Client nutzen.

Falls ihr diesen optionalen Native-Sign-up-Weg ebenfalls nicht anbieten wollt, könnt ihr in eurem Nginx-Serverblock vor dem allgemeinen location /-Block Folgendes ergänzen. Das Beispiel setzt den in vielen Mastodon-Nginx-Configs vorhandenen @proxy voraus:

location = /api/v1/accounts {
  limit_except GET {
    deny all;
  }
  try_files $uri @proxy;
}

Damit erhält nur POST /api/v1/accounts ein 403. Der lesende GET-Endpoint bleibt erreichbar. Danach wie immer nginx -t und erst bei erfolgreichem Test reloaden.

#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub

Is there a way to block registrations from any e-mail that has a subdomain in it? #AskFedi #MastoAdmin

Something at IP starting with 43.172.*.* and 43.173.*.* is scraping fedi tags via my instance... lots of tags. IP ranges comes back to "ACEVILLEPTELTD", a Singapore company
#MastoAdmin

43.173.179.148 - - [17/Sep/2026:00:00:38 -0400] "GET /tags/paymentprocessors HTTP/1.1" 502 1470 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"

https://networksdb.io/network/ACEVILLEPTELTD-SG

Updated to v4.7.2
#mastoAdmin

Quick heads-up for other Mastodon admins: this registration spam wave isn't over yet.

On lsbt.me, we first saw a flood of API registrations using Python/aiohttp. The telltale signs were usernames following the pattern bp plus 16 hex characters, and the sign-up reason was always "Automated protocol deliverability probe". A narrow block on that user agent stopped the first wave.

Today, however, five new registrations came in with the same usernames and the same sign-up reason. This time the bot simply identified itself as Chrome 126. That's exactly why a user agent is only useful as a short-term filter. It's a header the client can set to anything.

The requests go to POST /api/v1/accounts. This endpoint lets client apps create a new local account directly in the app. No app needs it for OAuth connections to existing accounts. #FediSuite doesn't use it either. It registers itself via /api/v1/apps, obtains consent via /oauth/authorize, and then works with a user token. Regular sign-up through the Mastodon website is also handled separately via POST /auth.

So I've completely disabled API account creation on lsbt.me. Web sign-up, OAuth, and existing clients keep working as before. Anyone who wants a new account just signs up once on the web as usual and can then use any client.

If you'd also rather not offer this optional native sign-up path, you can add the following to your Nginx server block, before the general location / block. The example assumes the @proxy location that many Mastodon Nginx configs already include:

location = /api/v1/accounts {
  limit_except GET {
    deny all;
  }
  try_files $uri @proxy;
}

This returns a 403 only for POST /api/v1/accounts. The read-only GET endpoint remains reachable. As always, run nginx -t afterwards and only reload once the test passes.

#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub

Rsyncing 600+GB from the old server to the new one to get back all the c#cat picture everyone published over the course of the last three year is sure an experience but I least we're back on track

#mastoadmin #rsync #migration

Post 2 of 2

Let's look even closer at that video — setting aside the obvious conflict of interest — and actually dissect what’s going on.

1st, notice how the person is deliberately holding a pair of brand-new crutches while sitting comfortably. The whole point is to project an image of vulnerability, implying they're injured.

2nd, look at the window: it's a solid, fully framed fixture. In fact, it’s the exact type you’d expect to see in a basement — heavy enough that they have to use a stick to prop it open.

3rd, if you think they're in a tent, look again. Not only is there a rigid, framed window, but those moving "walls" aren't a tent at all; they are brand-new bed-sheets with the fold creases still visible. They’ve been tacked up and billowed by a fan to simulate movement. Yet, for a brief moment, a drop-tile ceiling enters the frame.

#GazaVerified #Scam #Spam #Fraud #MastoAdmin #FediAdmin

Gaza Verified 's own videos speak for themselves.

The so-called spokesperson, you learn, doesn't even speak the language, uses that girl as an interpreter, and she is one of the people asking for donations too. It is all in-house, with everyone having a conflict of interest.

This is only one out of many videos I have collected over time.

https://hel1.your-objectstorage.com/catodon/87696553-a7c1-488c-ae70-979a760da13d.mp4

Post 1 of 2

#GazaVerified #Scam #Fraud #Spam #MastoAdmin #FediAdmin

Post 2 of 2

1st, notice how the person is deliberately holding a pair of brand-new crutches while sitting comfortably. The whole point is to project an image of vulnerability, implying they're injured.

2nd, look at the window: it's a solid, fully framed fixture. In fact, it’s the exact type you’d expect to see in a basement — heavy enough that they have to use a stick to prop it open.

3rd, if you think they're in a tent, look again. Not only is there a rigid, framed window, but those moving "walls" aren't a tent at all; they are brand-new bedsheets with the fold creases still visible. They’ve been tacked up and billowed by a fan to simulate movement. Yet, for a brief moment, a drop-tile ceiling enters the frame.

#GazaVerified #Scam #Spam #Fraud #MastoAdmin #FediAdmin

In the last week https://archaeo.social has received 398 AI-generated spam signup requests vs. 1 genuine human one. Unfortunately we might be at the point where it's more efficient to just disable registration entirely and say, "email a mod if you want an account" :/

#MetaArchaeoSocial #MastoAdmin #Slop

#MastoAdmin where is this message supposed to appear? Opening a private browing tab and clicking the sign-up button on my instance just gives a generic "sign-ups are closed" message

Alt...

A screenshot of a text input box from the administration -> settings page on Mastodon. The prompt reads "Custom message when sign-ups are not available / Displayed when sign-ups are closed". The text I have entered reads "Sign-ups are temporarily closed due to spam. Please email jenbanim@gmail.com if you would like to join this server"

We've upgraded our Mastodon server to v4.8.0-alpha.3+mementomods-2026-09-15. That is 98 new commits from upstream since our 6.9.2026 build.

Mastodon 4.7.2 is a security release and it is folded into this build.

🔒 Security

- HEIF and AVIF image decoding has been turned off. These are the formats iPhones use for photos. Mastodon calls this a temporary measure, so it will likely come back once the underlying issue is resolved upstream. No advisory has been published for it yet.

What this means in practice: if you upload a photo straight from an iPhone as HEIC, or an AVIF image, it will now fail instead of being converted. Most phone apps and browsers already hand over JPEG, so many of you will never notice. If an image upload does fail, save or export it as JPEG or PNG and it will go through. Images already uploaded here are unaffected, they were converted at upload time and are stored as JPEG.

🔧 Fixes & improvements

- Replies appear in the right order again (https://github.com/mastodon/mastodon/pull/40481).
- You get the confirmation prompt again when you navigate away with an unsent post (https://github.com/mastodon/mastodon/pull/40478).
- Oversized images are caught before the upload starts instead of failing at the end of it (https://github.com/mastodon/mastodon/pull/30475).
- Submitting the same post twice no longer produces a 500 error (https://github.com/mastodon/mastodon/pull/40439).
- The picture in picture video player no longer slides underneath the side panel (https://github.com/mastodon/mastodon/pull/40484).
- Importing a JSON file that is not a custom filter export now gives a proper error instead of a 500 (https://github.com/mastodon/mastodon/pull/40449).
- Privacy policy links in subscription emails point to the right place (https://github.com/mastodon/mastodon/pull/40486).
- Email footer spacing around our custom footer text is fixed (https://github.com/mastodon/mastodon/pull/40440).
- Counts in the interface are pluralised properly in more places (https://github.com/mastodon/mastodon/pull/40464).
- The standalone Pinned Posts page and its keyboard shortcut have been removed upstream (https://github.com/mastodon/mastodon/pull/40494). Pinned posts still show on profiles exactly as before, only the separate page is gone.

🛡️ Moderation

- Canonical email blocks no longer interfere with freezing or approving accounts (https://github.com/mastodon/mastodon/pull/40463).
- The admin account page now shows whether an account is blocked from trends and follow recommendations (https://github.com/mastodon/mastodon/pull/40398).
- Deleting notification requests in bulk now cleans up the notifications along with them (https://github.com/mastodon/mastodon/pull/40393).

🚀 Under the hood

- The 5.0 redesign took 37 of the 98 commits: the new navigation in the advanced multi-column layout, link cards, quotes, hashtags, the translation button, the post actions menu, and menus shown as sheets on mobile. All of it stays behind a flag, so nothing changes for you yet.
- Deleting an account now also deletes any annual reports generated for it (https://github.com/mastodon/mastodon/pull/40394).
- Reattaching an account with the command line tools clears the pending deletion timestamp (https://github.com/mastodon/mastodon/pull/40430).

📦 Dependency updates

- Routine bumps and translation updates.

🏠 Changes specific to our server

- Signing up through an app now requires an invite. The sign up form on the website is behind Turnstile, but the API path that mobile apps use was not, and a wave of bots had been coming through it for days, filling our moderation queue with fake applications. Requiring an invite closes that path. The normal sign up form on the website is untouched and works exactly as before, so if you are pointing someone here, send them to the website.
- Our periodic search index rebuild had been failing with an error since the 6.9.2026 build and now runs again. Live search was never affected by this, only the scheduled full rebuild.

Source code: https://github.com/mementomori-social/mastodon

As always, if you notice anything unusual or buggy, please reach out to me or any of the admins. Enjoy your time here, and feel free to message me with any questions or thoughts.

If anything feels off, please let us know!

#MementoMoriSocial #Mastodon #MastoAdmin

We just released Mastodon v4.7.2, v4.6.8, v4.5.18 and v4.4.25.

In addition to several bugfixes, they disable HEIF processing to avoid a known critical security issues. We encourage server administrators to update as soon as possible.

Full release notes and update instructions are available on the GitHub releases page.

https://github.com/mastodon/mastodon/releases

#MastoAdmin

v4.6.8

Changelog Security Temporarily disable HEIF support Fixes Fix relative privacy policy links in subscription emails (mastodon#40486 by @crafkaz) Fix canonical email blocks interfering with freezing or approving users (mastodon#40463 by...

https://github.com/glitch-soc/mastodon/releases/tag/v4.6.8

#glitchsoc #glitch #mastodon #mastoadmin

v4.4.25

NoteWhile we continue to support Mastodon 4.4 and release patches for it, please note that Mastodon 4.6 is available with new features, changes and fixes. We encourage administrators to update to the latest 4.6 version when they...

https://github.com/glitch-soc/mastodon/releases/tag/v4.4.25

#glitchsoc #glitch #mastodon #mastoadmin

v4.5.18

Changelog Security Temporarily disable HEIF support Fixes Fix canonical email blocks interfering with freezing or approving users (mastodon#40463 by @ClearlyClaire) Fix account deletion not deleting generated annual reports (mastodon#40394 by...

https://github.com/glitch-soc/mastodon/releases/tag/v4.5.18

#glitchsoc #glitch #mastodon #mastoadmin

Look! A news bot! That can't tell Columbia SC from Washington DC! I think I smell AI!

Hosted on a ghost instance!

With a website that returns ERR_HTTP2_PROTOCOL_ERROR!

Let's give it a rousing Fediverse welcome!

https://vive.im/@dc/117267754117646883

#mastoadmin

JESUS GODDAMN CHRIST. #mastoadmin

Alt...

A bunch of bot signups with the reason "automated protocol delivery probe"

Due to the ever-growing amount of LLM-generated subscription requests (that have to be moderated manually), I'm considering setting Mapstodon.Space to invite only.

I'm not fond of this at all but it's getting more out of hand everyday. Any suggestion on how to deal with this fake accounts crap flood will be very welcome. (Bonus points if you're on the moderation team of another instance and you are dealing, or have dealt with, a similar situation!)

#MapstodonSpace #MastoAdmin

Oh, so the bot account flood reached #GlitchySocial as well. I just didn't notice it because I got no emails...

#Mastodon #MastoAdmin

We had a big wave of automated Mastodon signups with very predictable usernames.

I first tried the sledgehammer approach and blocked known VPN ranges at the firewall.

It worked.

It also blocked legitimate ProtonVPN users. 😬

So I replaced that with a tiny custom Mastodon validator that rejects the actual abusive username pattern instead.

Much cleaner: block the abuse, not the transport.

How-to + code:
https://gist.github.com/chofstede/a422427570004719196cde948521dd04

#Mastodon #Mastoadmin #Fediverse #SysAdmin #Ruby #Rails #Security @tux @AlienJay @aping

so far no new registration #spam since 2 days. With an additional #fail2ban filter and 24h block everything calmed down quite nice.

#mastoadmin #bpSpam

I kept getting a 500 error when I tried to post something using a hashtag. Turns out, I was using a misspelled hashtag that I had blocked from being able to be used in a post on my instance. A brief notice did appear and disappear about the hashtag not being able to be used but it came and went much faster than the blue 500 error that popped up. I missed it the first three times I tried to post. #MastoAdmin .

I've noticed significant amount of requests towards the path /packs/*.js files on my Mastodon instance...

What's that about?

#MastoAdmin

RE: https://mastodon.iftas.org/@iftas/117241028973791986

Wir haben temporär die Registrierung bei uns komplett deaktiviert, weil wir aktuell massive unter Spam-Anmeldungen zu leiden haben.

#mastoadmin #nrwsocial

RE: https://mementomori.social/@rolle/117239751453109028

I looked into the bot issue again today. It turns out the bots aren't cracking Turnstile, they are bypassing it entirely by registering directly through the API (POST /api/v1/apps -> /oauth/token -> /api/v1/accounts). Turnstile, CAPTCHAs, and similar tools only protect web signups.

Because of this, blocking usernames, IPs, or email addresses doesn't help for long, as the bots keep rotating them and they are completely randomized.

I added a quick check to our fork in the Api::V1::AccountsController#check_enabled_registrations method: if API_REGISTRATIONS_REQUIRE_INVITE=true is set in .env.production, API registrations will require a valid invite code and return a 403 error otherwise. This does not affect regular signups.

The invite code cannot be guessed, so this should put an end to the issue. We could also achieve the same result in Nginx by blocking POST /api/v1/accounts, but I am not entirely sure what complications that might cause.

We are in the middle of a server migration, so we're keeping work on this to a minimum right now. We'll look into Anubis or Cloudflare anti-bot protections later.

We'll keep an eye on the situation.

#MementomoriSocial #MastoAdmin #Bots

New solution for #BoomProbe with lua-nginx-module

#mastoadmin #spam #gotcha #BoomProtocol

Alt...

this image shows a part of a nginx configuration

https://about.iftas.org/2026/09/11/boom-protocol-spam/ will re-post useful tips, tricks, guidance to combat the #bpSpam wave impacting many service providers.

#BoomProtocol #BoomProtocolProbe #Spam #FediAdmin #MastoAdmin #PeerTubeAdmin #FediMods #Mastomods

I have... *1119 accounts* pending registration. Every single one is a "Automated protocol deliverability probe”. I so badly need the ability to just reject everything with the same request reason...

#MastoAdmin

The spam accounts from the last few hours ("Automated protocol deliverability probe") appear to be logging in via their own OAuth app called “BoomProtocolProbe.” So here's an attempt:

To prevent “BoomProtocolProbe” from registering, we created a trigger in the Mastodon database that checks the name BEFORE INSERT and blocks the app if it matches.

https://pad.pnpde.social/p/FUloCtoOiNZPX6d18-_r

#MastoAdmin #BoomProtocolProbe #FediBlock

Alt...

CREATE OR REPLACE FUNCTION block_boomprotocolprobe() RETURNS trigger AS $$ BEGIN IF NEW.name = 'BoomProtocolProbe' THEN RETURN NULL; END IF; RETURN NEW; END; $$ LANGUAGE plpgsql; CREATE TRIGGER trg_block_boomprotocolprobe BEFORE INSERT ON oauth_applications FOR EACH ROW EXECUTE FUNCTION block_boomprotocolprobe(); COPY oauth_applications TO '/tmp/oauth_applications.copy'; DELETE FROM oauth_applications WHERE name = 'BoomProtocolProbe';

Fellow #MastoAdmin people. Have you come across this registration bot with account details like this:

Reason: Automated protocol deliverability probe

And account details like this:
bp3de08dafada0d38a
@bp3de08dafada0d38a

Pro tip of the day:

Do not be the next buddy.social.

Keep your Fedi site relatively up to date.

#Hacked #MastoAdmin #FediAdmin

This is new. 😅

Messaged @ajroach42 to inform them that their site is using software so old that even the recommended solution is out of date. Made sure my site and their site were connected, and even searched for my username using their site — I found myself, no problem. 😇

Every admin — 100% — I have ever messaged concerning their software being out of date has been friendly and received my message well. 😎

This is the first time someone blocked me. I guess there is a first for everything, lmao. 🤣

Welcome retro.social to security_risk_domains.csv. You're site number 23 added to the list. 🤷 🤡

https://github.com/Fediverse-Express/Fediverse/blob/main/security_risk_domains.csv

#FediAdmin #MastoAdmin #Security

Alt...

A screenshot of a message which reads: @ajroach42@retro.social I noticed your site is using Mastodon 4.2.20, which was released on April 2, 2025, and is now discontinued. That branch (4.2.x) of Mastodon has several known security issues. In fact, it is so old that the final 4.2.x build was 4.2.29, and developers recommend upgrading to 4.3.x. However, that branch is also discontinued and contains security issues (with the last release being 4.3.23). All of this to say, your software is quite out of date, and your site is extremely vulnerable. The current release is 4.7.1.

Alt...

A screenshot showing the admin how now suspended access between my account and their site, so neither the admin or anyone else can see my post.

This is new. 😅

Messaged @ajroach42 to inform them that their site is using software so old that even the recommended solution is out of date. Made sure my site and their site were connected, and even searched for my username using their site—I found myself, no problem. 😇

Every admin—100%—I have ever messaged concerning their software being out of date has been friendly and received my message well. 😎

This is the first time someone blocked me. I guess there is a first for everything, lmao. 🤣

Welcome retro.social to security_risk_domains.csv. You're site number 23 added to the list. 🤷 🤡

https://github.com/Fediverse-Express/Fediverse/blob/main/security_risk_domains.csv

#FediAdmin #MastoAdmin #Security

Alt...

A screenshot of a message which reads: @ajroach42@retro.social I noticed your site is using Mastodon 4.2.20, which was released on April 2, 2025, and is now discontinued. That branch (4.2.x) of Mastodon has several known security issues. In fact, it is so old that the final 4.2.x build was 4.2.29, and developers recommend upgrading to 4.3.x. However, that branch is also discontinued and contains security issues (with the last release being 4.3.23). All of this to say, your software is quite out of date, and your site is extremely vulnerable. The current release is 4.7.1.

Alt...

A screenshot showing the admin how now suspended access between my account and their site, so neither the admin or anyone else can see my post.

1,112 accounts spreading spam or participating in scams, along with the people who promote, defend, or otherwise amplify their existence on the Fediverse.

You'd be amazed at how much more user-friendly and cleaner Mastodon or Misskey feels once you take out the trash.

Save as a CSV file, for example, block.csv, import (upload) the file, and merge it with your current block list.

https://github.com/Fediverse-Express/Fediverse/blob/main/block_spam_scam_users.csv

#Spam #Scam #Fraud #FediBlock #FediAdmin #MastoAdmin #Mastodon #Misskey #Fediverse

RE: https://lsbt.me/@christin/117248376636232175

We're receiving Spam registrations too.

Reason for joining:

Automated protocol deliverability probe

Example of username chosen:

bp7db8296eb763dff7

Example of entry in web server log:

180.4.59.44 - - [10/Sep/2026:16:40:02 -0600] "POST /auth/confirmation HTTP/1.1" 302 5493 "-" "Python/3.10 aiohttp/3.14.3"

#Mastoadmin #Spam #Fediadmin