Post #3836764

2026-07-15 15:43 UTC

A cluster of ~300 WordPress web sites have begun federating over ActivityPub and then bridging to ATProto, all Swedish, mostly blank. Could be innocuous, could be the beginnings of an ad-farm, could be something more troubling. We have no idea, but here's a list of domains in case anyone wants to poke around and see if there's anything to be gleaned. Please use all sensible precautions before visiting an untrusted domain. https://pastebin.com/8PHQg0ZW

Replies (7)

@collette@sfba.social 2026-07-15 17:22

@iftas@mastodon.iftas.org if I want to federate my (nascent) website, where do I start?

Open ##3838349
@spacebug@n4.mikronod.se 2026-07-15 16:00

@iftas@mastodon.iftas.org As a swede I would say that the websites I checked looks like normal valid websites. Could they be hacked through WordPress? Or is this a new thing in WordPress where it automatically sets up an ActivityPub thing? EDIT: I was wrong. It's NOT valid sites. It's something shady!

Open ##3840472
@proprietor@wandering.shop 2026-07-15 16:14

@iftas@mastodon.iftas.org Oh dear. Thanks for sharing that signal. I noted 2 days ago that AP-enabled wordpress sites are hashtag spamming, and that combined with tags.pub could be particularly bad at overloading noise on top of the signal. I hope the one I caught wasn't a harbinger of this, or we're going to start defederating Wordpress like mad.

Open ##3840475
@compute.yee.nu@bsky.brid.gy 2026-07-15 16:34

Is strangle like I know Swedish and these are sites with such vague content on them

Open ##3840476
@everydaycompute@app.wafrn.net 2026-07-15 16:34

@iftas@mastodon.iftas.org Is strangle like I know Swedish and these are sites with such vague content on them

Open ##3840480
@stux@mstdn.social 2026-07-15 20:29

@iftas@mastodon.iftas.org is there a .csv we can import? I have a bad feeling about this one

Open ##3841312
@sophie@social.translunar.academy 2026-07-15 16:35

@iftas@mastodon.iftas.org quickly taking a look at some, its all slop-coded homepages i found a few websites linking back to www [dot] umpteenth [dot] media (making a web search returns plenty of site in the given list) which is registred as Atdt AB in sweden; the homepage seems to be www [dot] atdt [dot] se which other than being dysfunctional it also requests ressources from localhost:8000; homepage makes it seem they want to scrape data TLDR: it looks like a data scraping company

Open ##3873299