wow these bots are next level markov chain

[liaizon@social.wake.st]

they have studied us deeply

[iftas@mastodon.iftas.org]

@liaizon ...and deeply fingerstache.

[iftas@mastodon.iftas.org]

@liaizon Observed on 77 domains so far, eg

https://electroverse.tech/directory?local=true&order=new
https://darmstadt.social/directory?local=true&order=new
https://h4.io/directory?local=true&order=new
https://imastodon.blue/directory?local=true&order=new
https://mast.qixto.com/directory?local=true&order=new
https://todon.ploud.fr/directory?local=true&order=new
https://wehavecookies.social/directory?local=true&order=new

[liaizon@social.wake.st]

@iftas oh shit thats a large scale attack! are you publishing the list as your finding it anywhere?

[liaizon@social.wake.st]

@iftas hey @w4tsn your instance it being hit with agentic bots signing up! turn off open registration!

[liaizon@social.wake.st]

@iftas hey @BentiGorlich your instance is being used for a large scale LLM driven bot network! turn off open registrations!!!

[iftas@mastodon.iftas.org]

@liaizon

The actors in question are monitoring our activity, so we are limited on what we can share publicly. We have a private group that shares observations, we work with various bot detector groups, numerous admins, and we reach out directly to impacted services with our observations and guidance on mitigating these account creations.

If admins are unresponsive or outright refuse to review these accounts, they are then considered for the Abandoned/Unmanaged list.

Suspected Portal Kombat Accounts

The Fediverse is increasingly used by state-sponsored disinformation and propaganda agents. We track accounts believed to be operated by the agencies and/or contractors, and we request account removals via reports, DMs, and email communications with affected service providers. One particular activity is believed to be the actions of the Portal Kombat network, aka "Pravda network",…

IFTAS (about.iftas.org)

[liaizon@social.wake.st]

@iftas ohh shit they mostly following @bsky.brid.gy. hey @snarfed.org @quillmatiq this is something yall might want to do some mitigation against

[mathias@rhizospherelabs.com]

@liaizon they might be running the basic “hipster ipsum” generator

[bornach@fosstodon.org]

@liaizon
Is that the next sequel to "Cloudy With a Chance of Meatballs"?

[liaizon@social.wake.st]

@mathias its interesting they are def agentic but they are not using any of the big models at all with this weird output

[lnkr@gts.burning.homes]

@liaizon @iftas I put together a list yesterday and send some reports https://pastebin.com/SYXufkaU but it's so much worse than that. Some of those don't have the bio and are pretty much dormant for the moment, barely detectable in any automatic manner that I could think of. After a few dozens of random reposts they tend to hatch into russian propaganda telegram channels reposters so I believe this time it's state-backed

[bornach@fosstodon.org]

@mathias @liaizon
Signs of late stage AI bubble when the free-tier LLM APIs have become so restricted that bots have to fall back on more primitive text generators?

[bentigorlich@wehavecookies.social]

@liaizon @iftas Will do. I noticed that they keep registering bots with a very weird and particular boost pattern...

[bentigorlich@wehavecookies.social]

@liaizon @iftas If any of these accounts are reported they get removed as soon as I see the notification. We're very actively moderating such accounts

[catgoat@meemu.org]

@liaizon another day, another freegan LMAO

[liaizon@social.wake.st]

hey @stux there are a ton on mstdn.social, maybe think about turning off open signups while you tackle this wave?

[iftas@mastodon.iftas.org]

@lnkr @liaizon it's this group: https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/

[liaizon@social.wake.st]

hey @mwadmin yall getting hit with agentic bots signing up, maybe time to turn off automatic signups till you do some moderation of accounts using your infra?

[iftas@mastodon.iftas.org]

@liaizon you know what, sure, here's a subset of the list, minus any we know have been suspended or the server was taken offline - New means it hasn't been classified yet

IFTAS SW-ISAC TLP:Clear - Suspected PK Accounts

Google Docs (docs.google.com)