craftxbox

@wild1145 @iftas The fact they're inactive makes me think aging or account trade rather than complete compromise, but i haven't witnessed enough accounts to be perfectly confident

#mastoadmin #fediadmin Seeing a new spamwave that i haven't seen reported on yet. Mass-mention combined with an open redirector, google.<tld>/share.google?<etc>, Seems to layer the redirection even further. One of these i saw redirected to a porn scam site but the latest ones seem to hit to a nya5.com and die there instead of completing.

Sample: https://ghostarchive.org/archive/RWnsm (whenever it finishes archiving, it hasn't yet at time of posting)
https://mastodon.world/@groupsorlink/117446815131910858 (probably will get deleted shortly)

@vantablack poking into this, the domain itself is still fine and active, but the IP behind it (which, has activity on abuseipdb) has become unreachable by their hosting provider, hetzner. They could at any moment switch to another provider and the domain will come back, though with measurable samples gone its probably not going to be easy to get spaceship to act and serverHold the domain.

we now finally have ModSecurity as a WAF for transfur.social. hopefully this helps me filter out automated spam way easier than the limited tools cloudflare gives us.

Bonus upside being able to do json-aware body text filtering for unacceptable content like CSAM hashtags and bigotry, which was previously done with a patch from fedibird that was rather flaky and sometimes just leaked stuff through for no discernible reason.

#fediadmin #mastoadmin

@donelias Neevermind, they are not, what the absolute fuck

@donelias seeing these too. they're all getting blocked by my fuckoff blocklist of datacenter IP ranges though.