Notices by allenZ (zhoal@c.im)

Embed this notice
allenZ (zhoal@c.im)'s status on Thursday, 29-Feb-2024 19:53:58 JST allenZ
in reply to

Update:
These instances have been unblocked:
m.mxin.moe
planetearth.social
det.social
mastodon-swiss.org
Ref: https://mastodon.de/@ErikUden/111940301222380638
In conversation about 9 months ago from c.im permalink
Attachments
1. No result found on File_thumbnail lookup.
  
  Erik Uden 🦣🍑:coffefied: (@ErikUden@mastodon.de)
  
  from Erik Uden 🦣🍑:coffefied:
  
  # To all Fedi Admins Currently Being hit with a Spam Wave: I've just released **v2.2.8 of The Mute List!** I'd be very happy about [a small donation](https://mastodon.de/@MastodonDE/110808633497349326) because I have very little time and I cannot really justify working on this list with my current schedule :mycomputer: There is a new type of spam, the same instances are affected as before. Those responsible in Japan are said to have been arrested. Without further ado... ***Limit these instances:*** [[Full List of Affected Instances Here](https://github.com/Mastodon-DE/blocklists/blob/main/spam/2024-02-15/2024-02-15-spam-mute-list.md)] Just get the list to download and import [here](https://github.com/Mastodon-DE/blocklists/blob/main/spam/2024-02-15/2024-02-15-spam-domain_mutes-erik-uden.csv). Simply import this list and you'll mute the 107 worst spam instances currently known to me! I've worked on it for multiple days, sometimes ~9 hours at a time verifying all lists sent to me manually. Limit first, defederate only in worst situations! **Reconsider re-federating with and un-silencing any of the mentioned instances once the spam is mitigated.** The admins of some of these may have just been asleep when this all started. ## Ban Spam Accounts via their E-Mail Domain **Block the following E-Mail Domain** and whatever temp Mail provider it resolves to: `chitthi.in` Just to be safe, block these ones too (*same provider*) - `mailto.plus` - `fexpost.com` - `fexbox.org` - `mailbox.in.ua` - `any.pink` All our spam accounts came from these E-mails. Since you probably have some of these accounts sleeping: `https://[your-instance.tld]/admin/accounts?email=%25%40chitthi.in` there just select all and press “Ban”. ## Find Remaining Spammers I've seen instances that fixed the spam issue but began being hit later again. The spammers might use new E-Mails, so here is a way to find and block them anyway: https://mamot.fr/@vincib/111946701929274350 ## IP Bans and TOR These spammers seem to be using the **TOR Network** as all of their IPs are TOR Exit Node IPs, hence an idea (*with some collateral damage if executed*) would be to ban all TOR exit node IPs for sign ups. I am personally against this idea as you'd also prevent users who simply wish to stay anonymous online (*political refugees, leakers of important documents, etc.*) from using your platform. For now, simply banning every user using a particular Spammer IP will not help and will merely ban users that try to stay anonymous! Not necessarily the spammers. ## How To Block All Temp E-Mails in the Future *If you want to prevent this from ever happening again, you should block E-Mails from Temporary Mail providers all together:* - **[Here is the list of all Temp email providers](https://github.com/disposable-email-domains/disposable-email-domains/)** (*there are both blocklist and allowlist*) - **[Here how to install it in Mastodon](https://codeberg.org/stvo/mastodon-ansible-nodocker#disposable-mail-blocking)** - **[The script that automatically pulls the list via Cronjob and imports it into Mastodon](https://codeberg.org/stvo/mastodon-ansible-nodocker/src/branch/main/playbooks/no_disposable_mail.yml)** - **[Script template](https://codeberg.org/stvo/mastodon-ansible-nodocker/src/branch/main/playbooks/templates/home/mastodon/addmaildomains.sh.j2)** Because of this, [hessen.social, for example, was not affected by the spam attack](https://darmstadt.social/@stvo/111940755074991980)! They had already banned the email domain the spammers used ages ago. In future updates on Mastodon, maybe Admins can simply click a button that says “Ban Temp E-Mail Providers” Automagically from the E-Mail Menu? There could be E-Mail categories that can be banned, such as temporary mails. ## Why did this happen? The real reason hundreds of us spent hours of our days during the spam on mitigating it is the following: [Cyberbullying Gone Global: Fediverse Spam and Operation Beleaguer](https://fedi.fyralabs.com/notes/9q0ouuuw3p) This is the full exposé @cappy@fedi.fyralabs.com has been working on regarding the February 15th Spam Attacks! Thank you @BrodieOnLinux@linuxrocks.online for [mentioning this post in a video](https://mastodon.de/@ErikUden/111979657514522171)! **Good luck, everyone!** Thanks for participating in the Fediverse Experiment! #FediBlock #FediAdmin
Embed this notice
allenZ (zhoal@c.im)'s status on Thursday, 29-Feb-2024 19:53:53 JST allenZ

We (C.IM) have blocked brunch of accounts and some Fediverse instances due to the recent "Black Cat Server" ( #黒猫サーバー ) spam flood. The list of instances we blocked are:
m.mxin.moe
dw.n1l.dev
misskey.kuromame048.net
cunnyborea.top
minidisc.tokyo
px.mathias777.com
social.cutefunny.net
det.social
birdon.social
mastodon-swiss.org
planetearth.social
We're aware that not all users on these instances are bad but actually victims, and some following / follower relationship between them and our users are lost after the ban. We're very sorry about that.
However, due to the amount of spam accounts and the limited human resource we have, it's not practicable for us to investigate every suspicious account to do it accurately.
If you are the one or familiar with admins of those instances, please notify them about the issue, and we're more than happy to unblock after things are sorted out.
If you are the admin of another Fediverse instance and still don't know what was happening, please refer to https://mstdn.party/@austin/111939937665555167
And for our adorable users, if you find any more spam posts, just report and we'll handle that.
In conversation about 9 months ago from c.im permalink
Attachments
1. Domain not in remote thumbnail source whitelist: s3.c.im
  
  C.IM
  
  C.IM is a general, mainly English-speaking Mastodon instance.
2. Domain not in remote thumbnail source whitelist: px.mathias777.com
  
  Px
  
  The mathias777 instance of pixelfed social network, feel free to post your dogs there
3. Domain not in remote thumbnail source whitelist: mastodon-swiss.org
  
  Mastodon-Swiss.org
  
  Dieser Mastodon-Server wird durch Lukas Frey betrieben (privat).
4. Domain not in remote thumbnail source whitelist: misskey.kuromame048.net
  
  MameCommunitySky(MCS)
  
  内容が"無いよう"だふたなり様専用鯖低スペックなので高負荷やめちくり～
5. Domain not in remote thumbnail source whitelist: social.cutefunny.net
  
  Cute 'n Funny Reborn
  
  Cute 'n Funny Reborn is a low-moderation instance. That means profane language, racial explitives, NSFW images & videos, insensitivity and contempt toward differences in sexual orientation and gender identification, and so-called “cyberbullying” are not guaranteed to be moderated and the responsibility is on the individual user to know in advance that they should use the tools available for themselves to moderate/curate their own experience.
6. No result found on File_thumbnail lookup.
  
  Austin Huang ❤️:verified: (@austin@mstdn.party)
  
  from Austin Huang ❤️:verified:
  
  #mastoadmin #fediblock #fediblockmeta TAKE ACTION NOW Between 5:12am and 6:15am UTC mstdn.plus was hit with 111 registrations that are part of the Japanese-language #spam, which were intercepted. 1. The accounts have "$USERNAME@chitthi.in" as email. (UPDATE: other tempmail.plus domains have been observed elsewhere.) 2. They appear to be solely using Tor exit nodes. (UPDATE: IP subnets removed; you can find a list of Tor exit nodes somewhere.) TAKE ACTION NOW

Public

Notices by allenZ (zhoal@c.im)

User actions

Following 0

Followers 0

Groups 0

Statistics

Feeds