Elektrine lite

← Feed

@sb@metroholografix.ca

Post #1532691

2026-04-22 15:31 UTC

I've noticed a very slow trickle of fake accounts registering at my instance recently. They put more work into them than normal: - they have somewhat convincing usernames - semi-reasonable descriptions - emails on custom domains (Hetzner vps usually) - unique IP per account (often same subnet) - uploads a profile pic & banner image - some of them boost a few posts from admin acct But then these accounts just sit there. They aren't spamming. What is their goal? #mastoAdmin #fediAdmin

Replies (11)

  • @sb@metroholografix.ca 2026-04-24 03:17

    So, yeah looks like it was #pravdaNetwork. Fun stuff. Very good.

    Open ##2395823

  • @sb@metroholografix.ca scary.....

    Open ##2395824

  • @dbrand666@mastodon.social 2026-04-22 15:40

    @sb@metroholografix.ca Any important elections coming up?

    Open ##2395825

  • @paul@oldfriends.live 2026-04-22 15:44

    @sb@metroholografix.ca A lot of times, nefarious accounts just sit idle for a long time before being called into action. It's also worthy to note, with Mastodon, users can setup interactions to be filtered under a special area in notifications for news accounts, as well as other settings... So, if a new account tries to send spam within the first 30 days, it will get filtered behind a special area in notifications. They could be for future nefarious use,

    Open ##2395826

  • @Quasit@kolektiva.social 2026-04-22 15:44

    @sb@metroholografix.ca Whatever it is, I wouldn't count on it being anything good! Something smells like billionaire to me...

    Open ##2395827

  • @kinetix@humanwords.party 2026-04-22 15:59

    @sb@metroholografix.ca Possibly data harvesting while waiting for some command? I think IFTAS had a post quite recently about a whole botnet that's creating tons of accounts, behaving kind of normally for awhile before they start doing... whatever it is they start doing (wow, having a short sleep is doing wonders for the memory).

    Open ##2395828

  • @troy@opencoaster.net 2026-04-22 16:24

    @sb@metroholografix.ca definitely will be used later. Had that happen here, they’d look legit for a while then start spamming. Luckily recently for me all of the spam signups have been pretty dang obvious.

    Open ##2395829

  • @synnfynn@corteximplant.com 2026-04-22 16:31

    @sb@metroholografix.ca Sounds like sleeper bot accounts. They're most likely monitoring your public instance feed, including non-federated instance-local-only posts as I noticed some aren't following other accounts, but check if an account is following them. I'd also check for any unexpected traffic to/from your instance on the wire when there shouldn't be any, just in case. But it's concerning.

    Open ##2395830

  • @sb@metroholografix.ca This sounds similar to a bot campaign which has recently unfolded on a number of instances including ours. They can talk their way through a manual signup review, leading some to think humans initiate the accounts. The Kolektiva bots initially boosted a few toots from local accounts. They post squalls of stochastic automated text, first in English, and then switching to Greek (!). They also post slop graphics. A thematic that emerges through the nonsense is clear, a focus on the Ukraine war which is derogatory to Ukrainians. IOW, actual Russian bots

    Open ##2395831

  • @sb@metroholografix.ca I've noticed similar accounts commenting on YouTube. They have been created years ago with minimal information, and suddenly they come out and go full throttle with pro-Russian arguments in debates on videos related to the US, EU and Ukraine. It's not ideal that Hetzner is hosting the email for them, but then again - if the Hetzner account is created by a EU citizen with Russian ties, it's almost impossible to detect. Personally I would contact the account owner and ask them a couple of follow-up questions and tell them to go elsewhere if I felt something was fishy.

    Open ##2395832

  • @iftas@mastodon.iftas.org 2026-04-23 05:30

    @sb@metroholografix.ca Please see: https://about.iftas.org/library/suspected-portal-kombat-accounts/

    Open ##2395833