If you don't encounter a lot of LLM-spam and obvious trolls in the Fediverse right now, then your mods are doing a lot of good, unpaid work. 👍
moderation
This is great!
"The way we handle reports is proportional, context-aware, and, wherever we can, aimed at helping people put things right rather than simply penalising them."
https://help.joinmastodon.org/article/20-moderation-decisions-and-appeals
And also, an official guide on how to make collections on Mastodon!
https://help.joinmastodon.org/article/19-creating-a-collection
#实例公告 封禁协同潜在的僵尸账户网络
今日检测并封禁了 5 个协同运作的僵尸账户
行为特征：
内容为 LLM 生成的无语义英文词句（虽然目前未做出实质性的危害，但是可能是为了养号，规避审查）
五个账户全部于2026年3月18日 17:52 — 2026年3月19日 23:50注册
账户Profile基本为：一段英文+emoji或者几段无意义英文句子
所有连接 IP 均属 Cloudflare 代理段
注册域名含一次性邮箱服务及高风险域名
已采取的措施：
封禁账户（经核查IP均为Cloudflare IP，未泄露任何用户隐私）：
@iwutyp 162.159.XXX.XX
@PhyllisReynolds 172.70.XXX.XXX
@ezob 104.23.XXX.XX
@uhux_xudym 104.23.XXX.XX
@Ethel_Robinson 172.68.XXX.XXX
封禁邮箱：
tmail.lt、maxseeding.vn、dqsbf.blema.io.vn、sphinx.launders.money、kimora.space
总结：
由于前段时间为了简化注册流程，关闭了人工审核
将开启“注册时需要批准”+“注册时需要提供理由”
如果大家有发现类似行为特征的新账户，相同邮箱域名/IP请谨慎辨别
本实例不欢迎任何恶意/不受管制的机器人注册
Edited 181d ago
Friendly reminder: last year I built FediMod FIRES, a protocol and reference server implementation for sharing moderation data.
I haven't yet been able to get anyone to adopt it or even signal intent to adopt. But regularly I see people complaining about the lack of data sharing when it comes to moderation, especially for combating spam, scams, and harassment. The tool is there, please use it!
Whilst I'm not actively working on FediMod FIRES this quarter, I did apply in November for a grant to continue that work, and last I heard a few weeks ago is that the grant made it to the next stage, so I may have some money again to fund development.
It's not 1.0.0 yet, because I decided it needed more work for me to be happy to call it that, but it is usable!
Installation is also super simple for data producers, literally two commands on debian or ubuntu boxes.
Learn more: https://fires.fedimod.org/manuals/reference-server/
We've closed signups on indieweb.social for the weekend after a huge increase in attempted spam sign ups.
We aren't the only instance going through this. Please show your support to the amazing moderators across the Fediverse! 💙 ☁️
#FediAdmin #SpamWave #Moderation #Admin #Indieweb #FediMod #MastoAdmin
Quick heads-up for other Mastodon admins: this registration spam wave isn't over yet.
On lsbt.me, we first saw a flood of API registrations using Python/aiohttp. The telltale signs were usernames following the pattern bp plus 16 hex characters, and the sign-up reason was always "Automated protocol deliverability probe". A narrow block on that user agent stopped the first wave.
Today, however, five new registrations came in with the same usernames and the same sign-up reason. This time the bot simply identified itself as Chrome 126. That's exactly why a user agent is only useful as a short-term filter. It's a header the client can set to anything.
The requests go to POST /api/v1/accounts. This endpoint lets client apps create a new local account directly in the app. No app needs it for OAuth connections to existing accounts. #FediSuite doesn't use it either. It registers itself via /api/v1/apps, obtains consent via /oauth/authorize, and then works with a user token. Regular sign-up through the Mastodon website is also handled separately via POST /auth.
So I've completely disabled API account creation on lsbt.me. Web sign-up, OAuth, and existing clients keep working as before. Anyone who wants a new account just signs up once on the web as usual and can then use any client.
If you'd also rather not offer this optional native sign-up path, you can add the following to your Nginx server block, before the general location / block. The example assumes the @proxy location that many Mastodon Nginx configs already include:
location = /api/v1/accounts {
limit_except GET {
deny all;
}
try_files $uri @proxy;
}
This returns a 403 only for POST /api/v1/accounts. The read-only GET endpoint remains reachable. As always, run nginx -t afterwards and only reload once the test passes.
#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub