We had a big wave of automated Mastodon signups with very predictable usernames.
I first tried the sledgehammer approach and blocked known VPN ranges at the firewall.
It worked.
It also blocked legitimate ProtonVPN users. 😬
So I replaced that with a tiny custom Mastodon validator that rejects the actual abusive username pattern instead.
Much cleaner: block the abuse, not the transport.
How-to + code:
https://gist.github.com/chofstede/a422427570004719196cde948521dd04
#Mastodon #Mastoadmin #Fediverse #SysAdmin #Ruby #Rails #Security bbₜᵤₓᵢ (npub1zyt…u6da) Jörg 🇩🇪🇬🇧🇪🇺 (npub1qx9…3z0c) Aping (npub1shv…nk25)
Larvitz :fedora:
npub1fj…jaq90
2026-09-13 09:47:28 UTC
Author Public Key
npub1fj6u59lnses9xu6xa6ewugrfg2e639lg32r24383525xq3deyuaspjaq90Seen on
wss://relay.momostr.pinkPublished at
2026-09-13 09:47:28 UTCEvent JSON
{
"id": "42772cce051e6ad223cfea3d1cfdadf3431e4da6da35805f5f554a3d331a796f",
"pubkey": "4cb5ca17f38660537346eeb2ee206942b3a897e88a86aac4f1a2a86045b9273b",
"created_at": 1789292848,
"kind": 1,
"tags": [
[
"p",
"85d99145a0294a973cecee6c7245cfcea40bd7cda90e9af337beea1d9c1b7d29"
],
[
"t",
"ruby"
],
[
"proxy",
"https://burningboard.net/@Larvitz/117263096106057369",
"web"
],
[
"t",
"mastoadmin"
],
[
"t",
"fediverse"
],
[
"t",
"mastodon"
],
[
"t",
"sysadmin"
],
[
"t",
"rails"
],
[
"t",
"security"
],
[
"p",
"018b1f6b3f6e9ed68b4b317935264902cec526a0eb9902d40171332d67128b14"
],
[
"p",
"1116a5625de903a19514f0a9787fc298990506a318f10ae019402e4a25c0f381"
],
[
"proxy",
"https://burningboard.net/users/Larvitz/statuses/117263096106057369",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://burningboard.net/users/Larvitz/statuses/117263096106057369",
"pink.momostr"
],
[
"-"
]
],
"content": "We had a big wave of automated Mastodon signups with very predictable usernames.\n\nI first tried the sledgehammer approach and blocked known VPN ranges at the firewall.\n\nIt worked.\n\nIt also blocked legitimate ProtonVPN users. 😬\n\nSo I replaced that with a tiny custom Mastodon validator that rejects the actual abusive username pattern instead.\n\nMuch cleaner: block the abuse, not the transport.\n\nHow-to + code:\nhttps://gist.github.com/chofstede/a422427570004719196cde948521dd04\n\n#Mastodon #Mastoadmin #Fediverse #SysAdmin #Ruby #Rails #Security nostr:npub1zyt22cjaayp6r9g57z5hsl7znzvs2p4rrrcs4cqegqhy5fwq7wqsvpu6da nostr:npub1qx9376eld60ddz6tx9un2fjfqt8v2f4qawvs94qpwyej6ecj3v2qx53z0c nostr:npub1shvez3dq999fw08vaek8y3w0e6jqh47d4y8f4uehhm4pm8qm055sdhnk25",
"sig": "bf2b66d5532ed8ef66c4d59cf883abe0c7791f3c083aa201d7790f11a5322e3c9ba79f818aef561078c7dc7ca710f604e919beb99c23b50b3eccd43cb3e55e9a"
}