Well this is concerning.

[anticomposite@wikis.world]

RE: https://mastodon.iftas.org/@iftas/116426965511875330

@Viss @leo the current tactic seems to be getting a legit-looking account through review, then using invites (which bypass review) to create the spam accounts.

[viss@mastodon.social]

@anticomposite @leo oh interesting - you think there are approved accounts already in there that are farming invites out to the bots?

[ariarhythmic@ohai.social]

@leo Are existing members allowed to create invites that bypass review?

[serge@babka.social]

@leo

How did they circumvent your manual process?

[god@tlv.cool]

@leo concerning is an understatement here, Leo.

[hamishtpb@mewblog.thepolarbear.co.uk]

@leo Can I confirm - this is on Mastodon's server software?

[scattapilla@jorts.horse]

@leo looking at the account in modtools should say the inviter name, just ban them too

[oregon_pacifist@retro-gaiden.com]

@leo yeah, there was a wave of bots that joined my instance. Enabling Captcha didn’t slow them down at all. The only thing that helped was requiring new accounts to write a reason to join. Haven’t seen a bot since.

[brothercasas@twit.social]

@leo thanks for keeping this server safe.

[roryh@twit.social]

@leo thanks for putting in the effort to keep this instance clean!

[bob@beamship.mpaq.org]

@leo yep, mastodon 4.5.9 ...

[beet1123@twit.social]

@leo ims i had to give a reason to join

[oli@olifant.social]

@ariarhythmic @leo This is how it's being done by the 'Portal Kombat' crew. They use existing accounts and use server invites to bypass registration checks.

[iveyline@mastodon.nz]

@curiously @leo Yes, thanks a million. It is really appreciated.

[nihilistic_capybara@layer8.space]

@leo aren't traditional capchas kind of a solved problem in machine learning?

[evan@cosocial.ca]

@leo thanks for keeping vigilant, Leo!

[abeorch@friendica.ginestes.es]

@leo Didnt someone identify something about invite links circumventing manual approval?

[tartley@fosstodon.org]

@leo for 14 of them, couldn't the owners have just registered/captched them manually?

[wtfismyip@gnu.gl]

@leo I enabled server-status to investigate some other issue, but noticed there were a bunch of requests against my Mastodon instance.