Josh Knapp :verified: on Nostr: We have been getting bombarded with spam sign-ups lately from a botnet. Hundreds of ...

We have been getting bombarded with spam sign-ups lately from a botnet. Hundreds of them, same pattern every time: random hex username, gmail addresses reusing the same inbox with +tags, different IP on literally every request. Classic rotating-proxy spam farm hitting every instance it can find.

I thought they were filling out the form for sign up (since we did not have a captcha in place), but they were hitting the API endpoints pretty rapidly. Turns out third-party apps have their own registration flow separate from the website, and that's the path they were actually using. Which is why nothing I did to the sign-up page seemed to slow them down at first.

The fix ended up being both blocking the API sign-up AND adding a captcha to the form.

We already require manual approval on new accounts, so none of this actually went live, it was just clogging the queue and annoying me.

Learn from my mistake, check the logs before trying to form a solution.

#mastoadmin #fediblock