Nostr notes by IFTAS

Nostr event nevent1qqsg3qjnlmxtu02mp0ju6p2acusnv8gr9cz4mmvkkqgcqs8mvvrf7tczyq3gdtdew4gt39ea5vkmdy2kzfhrkdax85txcxcy9gra3yu6yhqzqudmj8d

2026-07-30T12:46:25Z

RE: https://about.iftas.org/2026/07/30/deprecation-notice-cariad-domain-observatory-transition/

Please be aware of our upcoming transition for the CARIAD domain observatory, and the new CARIAD files available.

quoting
note1q99…s0hv

The CARIAD Domain Observatory Web service (cariad.fedicheck.iftas.org) is being shut down. To ensure server administrators and moderation teams can retain access to reliable, consensus-driven moderation data, IFTAS is transitioning to a suite of downloadable and subscribable denylist files.

IFTAS is providing direct access to these lists in our Community Library: https://about.iftas.org/library/denylist-resources/#IFTAS_Domain_Denylist_Resources

Moving forward, you can select from tiered consensus levels based on observed blocking activity across the network, alongside the human-curated lists maintained by IFTAS:
https://about.iftas.org/library/iftas-cariad-denylist/">CARIAD Consensus Tiers: Available in 51%, 66%, and 80% agreement thresholds.
https://about.iftas.org/library/iftas-dni-list/">Do Not Interact (DNI) List: Our human-reviewed list of high-risk domains strongly recommended for defederation.
https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/">Abandoned & Unmanaged Domains (AUD) List: Curated list targeting dedicated spam services and unmoderated/abandoned instances.
(New) https://about.iftas.org/library/denylist-resources/#IFTAS_Domain_Denylist_Resources">Omnibus File: A single, comprehensive file that combines the 51% Consensus Tier, AUD, and DNI lists into one stream.

If you currently rely on automated scripts or tools pulling from cariad.fedicheck.iftas.org, please update your endpoints to point to the new resource files linked above. We don’t have a hard date for shutdown, but it will likely be by end of September 2026. To be clear, it is broken, you should stop using it as soon as you read this.###

The Denylist EcosystemWe want to acknowledge the broader community efforts pushing trust and safety forward:
https://fires.fedimod.org/">Emelia Smith’s FIRES for pioneering proactive moderation infrastructure,
https://pelago.1sland.social/blocklist">Oliphant’s Pelago service for continued leadership in federated denylist curation and accessibility,
https://about.iftas.org/library/denylist-resources/#Other_Denylist_Resources">Denylist Maintainers who publish their lists in a wide range of formats,
Platform Developers: We are deeply grateful for the ongoing work across various Fediverse platform teams to build native, automated, and streamlined methods for importing and managing trusted sources like IFTAS. Special shoutout to GoToSocial’s extremely well-thought-out implementation of automated list import, see https://docs.gotosocial.org/en/latest/admin/domain_permission_subscriptions/">https://docs.gotosocial.org/en/latest/admin/domain_permission_subscriptions/ for more.
###

Scalable Safety for an Expanding FediverseWith the rapid explosion of new domains federating, the operational overhead for volunteer admins and moderation teams has scaled exponentially. Federating with a new domain means opening an untrusted door; doing so safely requires real-time insight, shared metadata, and reliable reputational signals that don’t rely on single points of failure.

We firmly believe that the future of the Social Web rests on consent-based federation, where server administrators and users retain explicit control over who they connect with, backed by actionable, transparent reputational data. IFTAS is working on reputation metrics/signals to help identify common markers when encountering a new domain. More to come, watch this space!

As the ecosystem matures, IFTAS remains committed to supporting sustainable moderation infrastructure, advancing shared signals, and empowering server operators with the tools needed to keep the Fediverse safe, resilient, and connected.

If you need assistance selecting the right tier or denylist for your server, reach out on network IFTAS (npub1y2r…kvzk) or email contact@iftas.org

I think it falls under the rubric of perceived boundaries. ...

2026-07-23T16:49:44Z

In reply to nevent1q…dvhv
_________________________

I think it falls under the rubric of perceived boundaries.

Content was posted on a specific web site, and then forwarded off-platform.

The data subject likely held the belief that the content should not exceed the boundaries of the web site she was using, and the forwarding to a third party off-platform likely exceeded her expectations of reach.

"From Louisville/Jefferson, discovered Mushroom Hunting while ...

2026-07-23T16:26:53Z

"From Louisville/Jefferson, discovered Mushroom Hunting while working as Groundskeeper at PatientsLikeMe"

#BotSpotting

⚠️ #SW_ISAC_ADVISORY The following domain(s) are entering the ...

2026-07-18T17:49:34Z

⚠️ #SW_ISAC_ADVISORY

The following domain(s) are entering the IFTAS Abandoned/Unmanaged Domain (AUD) review process:

burma.social

These nodes are being overrun by coordinated botnets, and are unresponsive to reports, DMs, and Email communications.

If you have contacts at any of these services, please reach out and let them know we have been trying to contact them.

#Spam #FIMI #CIB #Disinformation

Thanks for the heads-up! One comment, your required reason is ...

2026-07-16T00:29:44Z

In reply to nevent1q…2kge
_________________________

Thanks for the heads-up!

One comment, your required reason is five characters or more, but one of the most common reasons is "Spam", which is four characters.

https://codeberg.org/derpepe/pepes-addons/src/branch/master/report/report.js

if (reason.length < 5) {
alert("The reason must be at least 5 characters long!");
return;
}

depends on the platform, what are you using?

2026-07-15T17:51:43Z

In reply to nevent1q…lxy4
_________________________

depends on the platform, what are you using?

yes. The AUD list would block the federating domain, the ...

2026-07-15T15:30:04Z

In reply to nevent1q…kmew
_________________________

yes. The AUD list would block the federating domain, the disposable list would help block new local accounts.

If anyone has a contact at @npub19mh…v9e6 please let them know ...

2026-07-07T21:37:20Z

If anyone has a contact at Assn for Computing Machinery (npub19mh…v9e6) please let them know IFTAS has sent DMs and Email regarding their Mastodon service, it's over-run with propaganda and disinfo bots and getting worse by the day.

𝗥𝗼𝘀𝗸𝗮 𝗕𝗿𝗶𝗱𝗴𝗲: how a pro-Russian ...

2026-07-02T13:52:21Z

𝗥𝗼𝘀𝗸𝗮 𝗕𝗿𝗶𝗱𝗴𝗲: how a pro-Russian IMS exploits vulnerabilities of decentralised platforms to spread propaganda

https://checkfirst.network/roska-bridge-how-a-pro-russian-ims-exploits-vulnerabilities-of-decentralised-platforms-to-spread-propaganda/

#FIMI #Disinformation

Evan, this is great news, glad the lists are of help. Are you OK ...

2026-07-01T19:57:29Z

In reply to nevent1q…85md
_________________________

Evan, this is great news, glad the lists are of help. Are you OK with me listing them as used by tags.pub on their home pages?

https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/

https://about.iftas.org/library/iftas-dni-list/

And if you're not auto-updating from source, the #SW_ISAC_ADVISORY tag will let you know when the lists are updated

The network grows and we've tripled the number of federating ...

2026-07-01T12:53:43Z

In reply to nevent1q…cly6
_________________________

The network grows and we've tripled the number of federating services in the past 12 months.

Opt-in or selective federation is the only way forward for many communities. No-one can individually vet and monitor 58,000 domains.

Kudos to Bonfire (npub14rp…za3l) for getting this stable and ready for production!

there are several activities to identify FIMI, inauthentic ...

2026-06-30T11:22:35Z

In reply to nevent1q…mhe0
_________________________

there are several activities to identify FIMI, inauthentic behaviour, and coordinated botnets.

Two examples:

https://about.iftas.org/library/known-spam-fediverse-services/

https://about.iftas.org/library/suspected-portal-kombat-accounts/

absolutely! Our immediate concern is the possibility of entire ...

2026-06-18T21:26:24Z

In reply to nevent1q…xzvy
_________________________

absolutely! Our immediate concern is the possibility of entire servers being taken over, but everyone who can should enable multi-factor to protect their account.

We're seeing a lot of account takeovers of old, unused ...

2026-06-18T14:56:23Z

We're seeing a lot of account takeovers of old, unused accounts. If your account has elevated privileges (eg admin or moderator access) we strongly advise you enable multi-factor authentication.

Please boost for visibility.

#FediAdmin #FediMods #MastoAdmin

The 2026 Social Web Operations Survey is open. If you're a ...

2026-06-17T13:48:37Z

The 2026 Social Web Operations Survey is open.

If you're a platform admin, community manager, or frontline moderator, this needs assessment is designed for you.

Your feedback helps protect every independent social web community builder.

Take part here:
➡️ https://tally.so/r/81MW6k

#FediAdmin #FediMods #TrustAndSafety

⚠️ #SW_ISAC_ADVISORY The following accounts were created by ...

2026-06-09T12:45:27Z

⚠️ #SW_ISAC_ADVISORY

The following accounts were created by an AI Agent that is creating accounts on numerous social media services. If your service disallows such activity, be aware of the account name "arihantdeva"

ref:
- https://privacysafe.social/@arihantdeva
- https://dev.to/arihantdeva
- https://dev.to/arihantdeva/200-accounts-wiring-the-fediverse-registration-coordinator-to-disk-48b9
- https://arihantdeva.prose.sh/note-1780747602
- https://arihantdeva.prose.sh/note-1780745475
- https://arihantdeva.prose.sh/note-1780655424
- https://arihantdeva.prose.sh/note-1780570703

⚠️ #SW_ISAC_ADVISORY The following domain will be added to ...

2026-06-08T15:10:24Z

⚠️ #SW_ISAC_ADVISORY

The following domain will be added to the IFTAS Abandoned/Unmanaged List with a "Silence" (aka "Limit") recommendation today Mon Jun 8, 2026

mastodon.lithium03.info

Although there is a single (local admin) authentic account active, the service is overrun by a known botnet. The service operator has communicated that the botnet has the legal right to create posts in the relevant jurisdiction, and will not remove the content nor the accounts.

#Spam #CIB #FIMI

We're at 33 supporters on our "Power of One" ...

2026-06-03T11:53:39Z

In reply to nevent1q…mjwh
_________________________

We're at 33 supporters on our "Power of One" campaign.

Keeping our research, open tools, and infrastructure free for the entire ecosystem requires sustainable support.

If you can you spare just 1 euro, dollar, pound a month, 12 a year to help us make sure we can keep the lights on it makes a huge difference.

And if you can't, please spread the word. Sharing our tools and resources is the most helpful thing you can do to support the network.

Join us, support us: https://givebutter.com/iftas-power-of-one

I will be traveling later today to attend the PublicSpaces ...

2026-06-03T11:49:37Z

In reply to nevent1q…qjjq
_________________________

I will be traveling later today to attend the PublicSpaces Conference in #Amsterdam titled "Technology for Democracy" https://conference.publicspaces.net/en to collaborate with others building a safer, independent social web.

If you're attending, let's connect!

Every year IFTAS surveys a broad range of community builders to ...

2026-06-03T11:46:02Z

Every year IFTAS surveys a broad range of community builders to learn what's working and what's not.

As we prepare for our upcoming annual survey, now's the perfect time to look back at the data driving our work. If you want to see the real challenges currently facing server admins, moderators, and community managers, you can read our full 2025 report here:

https://about.iftas.org/wp-content/uploads/2026/01/Social-Web-Trust-Safety-Needs-Assessment-Report-2025.pdf

This data isn't just academic, it shapes what we work on, advocate for, and seek to support.

The Russian botnet has now created over 2,500 inauthentic ...

2026-05-29T12:37:25Z

The Russian botnet has now created over 2,500 inauthentic accounts on 180 Mastodon servers. These accounts spam propaganda, follow each other to increase federation, connect to Bluesky via the bridge to spread their content there, and create unlimited invite links for their bots to follow.

IFTAS reports each one we find, and to date roughly 60% of these accounts have been suspended.

Our AUD denylist would silence or suspend the bulk of the remaining 40% of accounts.

https://about.iftas.org/library/suspected-portal-kombat-accounts/

quoting
note1fu6…dwr3

The Fediverse is increasingly used by state-sponsored disinformation and propaganda agents. We track accounts believed to be operated by the agencies and/or contractors, and we request account removals via reports, DMs, and email communications with affected service providers.

One particular activity is [believed to be the actions of the Portal Kombat network](https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/ ), aka “Pravda network”, which has created thousands of accounts on hundreds of servers.

Some providers do not remove these accounts when notified, therefore the accounts below represent a sample of what these accounts look like, what they post, how they present themselves. This may help admins and moderators in identifying these accounts, and identifying common IP addresses and MX records that can be used to flag or suspend new registrations from this network.

https://social.roadfm.fr/@akusa
https://social.roadfm.fr/@anyrum
https://social.roadfm.fr/@effiebryant
https://electroverse.tech/@concepcion_thiel
https://electroverse.tech/@jocelynsullivan
https://electroverse.tech/@ugiz
https://todon.ploud.fr/@bemelan
https://todon.ploud.fr/@cogegom
https://gs.leftic.club/@abiegh
https://gs.leftic.club/@Aeciva
https://gs.leftic.club/@Aeliphe
https://gs.leftic.club/@agachu
https://gs.leftic.club/@amaesho

If you value this work and want to see our safety resources stay ...

2026-05-28T12:28:13Z

In reply to nevent1q…5uac
_________________________

If you value this work and want to see our safety resources stay online, independent, and active, please consider joining our Power of One campaign.

We are looking for 500 supporters to contribute just 1 (£, €, $) a month. Small change, big difference.

Support IFTAS here: https://givebutter.com/iftas-power-of-one

⚠️ #SW_ISAC_ADVISORY The following domain(s) are entering the ...

2026-05-28T12:23:00Z

⚠️ #SW_ISAC_ADVISORY

The following domain(s) are entering the IFTAS Abandoned/Unmanaged Domain (AUD) review process:

mstdn.at
paxation.info
sigmoid.social
zirk.us

These nodes are open registration, are being used by coordinated botnets, and are unresponsive to reports, DMs, and Email communications.

If you have contacts at any of these services, please reach out and let them know we have been trying to contact them for three weeks.

#Spam #FIMI #CIB

https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/

RE: https://masto.ai/@Nonilex/116612907554964438 #MastoAdmin ...

2026-05-21T14:41:58Z

RE: https://masto.ai/@Nonilex/116612907554964438

#MastoAdmin #MastoMods community should be on the alert for hijacked accounts. We have observed some signals of dormant accounts suddenly being used in the past two or three weeks.

quoting
note1s9e…vcv9

Gee, ya don’t say …

#Bluesky Says #Kremlin Is Hacking Its Platform to Spread #Propaganda

The company said it was fighting Russian efforts to hijack real #users’ accounts to post fake #content, an apparently novel tactic.

#MediaLiteracy #disinformation #misinformation #Russia #RussianPropaganda #tech #SocialMedia
https://www.nytimes.com/2026/05/21/business/bluesky-russia-hacking-accounts.html?smid=nytcore-ios-share

the program appears to be attempting to convert times to my local ...

2026-05-19T15:46:07Z

In reply to nevent1q…kn8p
_________________________

the program appears to be attempting to convert times to my local times, but is only getting halfway. I think I have it figured out, but is there a just-show-NL-times option?

Spot-the-not-a-bot! One of these profile bios is not a bot, can ...

2026-05-14T13:45:27Z

Spot-the-not-a-bot! One of these profile bios is not a bot, can you tell which one?

Option 1. Born in Cook Islands, moved into Bartender after studying COBOL

Option 2: Graphic Designer focused on cordless with an eye for Aquamarine design

Option 3: Living by the sea, guided by the stars. Moon-minded. Tide-pulled. Alchemist.

Option 4: Low-fi 90's.

#BotWatching

I do not see any active account on your service in our data, but ...

2026-05-07T11:26:25Z

In reply to nevent1q…qmne
_________________________

I do not see any active account on your service in our data, but if there is something you want me to specifically review, please DM me.

I want to emphasise that mastodon.uno is a stellar example of a well-moderated instance. The dedication of your volunteer staff is evident, and you have my complete respect for the proactive measures you take to keep the Fediverse safe.

>Your identification of the account was carried out through ...

2026-05-07T11:25:58Z

In reply to nevent1q…akfz
_________________________

>Your identification of the account was carried out through automated processing (scraping)

To be clear, I spend roughly two hours per day, every day, manually reviewing accounts, looking at over 150 instances. There is no scraping of any kind. Just me and my mouse.

I have two lists, the new one starting in April. Any accounts not suspended on the old list were brought forward to the new list, generating new reports for older accounts.

Over 2,000 accounts now being tracked on the Russian Botnet ...

2026-05-06T22:44:10Z

Over 2,000 accounts now being tracked on the Russian Botnet infecting the fediverse.

35% of them would be silenced or suspended by the IFTAS AUD list.

More info: https://about.iftas.org/library/suspected-portal-kombat-accounts/

⚠️ #SW_ISAC_ADVISORY Previously-federating domain ...

2026-05-05T22:03:01Z

⚠️ #SW_ISAC_ADVISORY

Previously-federating domain

chinanews[.]social

is no longer an ActivityPub service, and is now serving auto-downloaded malware.

Last observed federation was 2026-01-29

Database purge of cached posts may be appropriate to reduce serving links to this exposed domain.

#Malware

>I notice they are on the latest Mastodon version so it looks ...

2026-05-05T17:56:52Z

In reply to nevent1q…7ur6
_________________________

>I notice they are on the latest Mastodon version so it looks like someone is watching out for the instance.

They are on Masto.Host, so updates are applied for them.

Next up will be DMs, Emails, if that fails will try via DNS records and any and all additional communication options before any action is taken, and that action will factor in the current use of the service by non-bots.

The AUD process is slow and cautious, taking at least three weeks ...

2026-05-05T17:52:16Z

In reply to nevent1q…n6t7
_________________________

The AUD process is slow and cautious, taking at least three weeks and multiple communication channels. The review process will factor in the active members contrasted with the bot actors (among other signals).

Being announced merely means they are at the very beginning of that three week review process, after ten days of inaction on multiple reports made to the service.

And please note, AUD does not always recommend a suspend, it may recommend a monitoring process, or a "limit".

STA seems to focus on software development and maintainers, most ...

2026-05-05T17:48:31Z

In reply to nevent1q…65th
_________________________

STA seems to focus on software development and maintainers, most grant-making organisations don't fund ongoing operations. I'd be happy to participate in standards development if I had the time, but the day-to-day of what IFTAS does (and no longer does because it was too expensive to operate) is what I'm hoping to keep funded.

⚠️ #SW_ISAC_ADVISORY The following domain(s) are being ...

2026-05-05T17:42:46Z

⚠️ #SW_ISAC_ADVISORY

The following domain(s) are being escalated to the Abandoned/Unmanaged Denylist (AUD) review process:

sigmoid.social

#CIB #FIMI #Spam

More about AUD: https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/

Although we've had to shut down some services, IFTAS is still ...

2026-05-05T17:28:52Z

Although we've had to shut down some services, IFTAS is still working on:

- Human-reviewed denylists
- Threat sharing
- Community library
- Regulatory compliance
- Mod tooling

If you'd like to donate to help keep this effort alive, please see https://about.iftas.org/donate/

We accept direct donations, GitHub sponsorships, Benevity (double your donation!), DAFs, stock and cryptocurrency, all tax-deductible in the US.

Starting in tax year 2026, if you do not itemise, you may still deduct up to $1,000

⚠️ SW-ISAC Advisory The IFTAS Do Not Interact domain denylist ...

2026-04-29T19:41:01Z

⚠️ SW-ISAC Advisory

The IFTAS Do Not Interact domain denylist has been updated.

Recent additions have been identified as federating CSAM, based on human review.

If your service imports the IFTAS DNI denylist, please update accordingly.

https://about.iftas.org/library/iftas-dni-list/

#SW_ISAC_Advisory #CSAM

yep, there's a few there, reports incoming

2026-04-24T21:44:42Z

In reply to nevent1q…ey78
_________________________

yep, there's a few there, reports incoming

I am testing out some reporting functionality and it appears some ...

2026-04-24T18:42:22Z

I am testing out some reporting functionality and it appears some servers will have gotten two or three reports for the same account, apologies.

got it, will continue hanging in 🙏

2026-04-23T19:51:48Z

In reply to nevent1q…hlff
_________________________

got it, will continue hanging in 🙏

good feedback, thank you. I'll dial it back.

2026-04-23T18:57:38Z

In reply to nevent1q…y0q2
_________________________

good feedback, thank you. I'll dial it back.

thanks, that's really helpful to hear.

2026-04-23T17:09:45Z

In reply to nevent1q…lg94
_________________________

thanks, that's really helpful to hear.

untagged, apologies, I didn't notice the post was also a ...

2026-04-23T16:54:03Z

In reply to nevent1q…kflv
_________________________

untagged, apologies, I didn't notice the post was also a reply (to you)

Having a hard time figuring out which kind of message resonates ...

2026-04-23T16:28:00Z

In reply to nevent1q…z2fu
_________________________

Having a hard time figuring out which kind of message resonates with folks and/or figuring out if I should stop doing this work if nobody really needs it done.

Please see the emails and direct mentions sent by iftas.org on ...

2026-04-23T16:26:25Z

In reply to nevent1q…fcyw
_________________________

Please see the emails and direct mentions sent by iftas.org on Jan 16, Feb 5, and I'll send another one today.

I am also performing free work. So are all the Fediverse admins you federate with.

I understand maintaining a Mastodon server is hard work. I strongly suggest you disable new account creation or only allow it with review and approval.

As far as I can tell, you are the only active human on the service.

Nostr event nevent1qqsf46czqnppdk0yacrzxwhpeufrvlanlgkaeerfj34ztl8l5e86x0czyq3gdtdew4gt39ea5vkmdy2kzfhrkdax85txcxcy9gra3yu6yhqzqs3ygct

2026-04-23T16:14:51Z

In reply to nevent1q…c8ge
_________________________

https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/

quoting
note1rs0…97et

Indicators of compromise (IOCs) that identify accounts as likely being part of the network include:
a single follow (the bsky.brid.gy @ bsky.brid.gy account), or first follow is the bridge
followers and following hidden from public
registration after September 8, 2025
linking to pro-Russia Telegram channels, or Russian news sources
posts that cut off mid-sentence
masquerading as legitimate news organisations
disposable email domains used for the account registration

The accounts are created and left alone for a short period, and will have no posts for up to week, sometimes more.

Once in use, the account will likely follow a dozen or so accounts on servers that are listed on the [AUD Denylist](https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/ ).

*Update November 21: with over 750 accounts and growing, we will no longer be updating the daily accounts tracker and instead will be focussing on identifying the domains known to be wholly unmanaged or unmaintained, please see the [IFTAS Abandoned and Unmanaged Domain (AUD) Denylist](https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/ ) page for more details.*

*Update October 25: Accounts are still being created (571 observed so far), and a number of servers are either unwilling or unresponsive in removing these accounts. A list of servers recommended for limiting or defederating is now available at https://about.iftas.org/library/known-spam-fediverse-services/#Unmanaged_Unmaintained_Abandoned_Servers*

*Update October 14: Accounts are still being created, and unused accounts registered earlier are being activated.*

Since 15 September, IFTAS has been tracking a coordinated network of over 300 accounts operating across Mastodon. These accounts are engaged in a high-volume propaganda campaign, promoting pro-Russian narratives and linking to Telegram channels associated with known state-aligned disinformation operations.

We became aware of a related investigation by the [Antibot4Navalny](https://bsky.app/profile/antibot4navalny.bsky.social ) research team that observed these accounts bridging to Bluesky, and we have since collaborated to enhance our investigations and share our findings. Their [public post](https://bsky.app/profile/antibot4navalny.bsky.social/post/3m22256476k25 ) provides further context.

Antibot4Navalny’s observations identified additional impacted services we were unaware of, and highlighted that accounts were still being created. Furthermore, thanks to their specific expertise in this area, this helped clarify and confirm that what we were seeing was indeed the work of a coordinated campaign with an increased likelihood of it being a state-sponsored or state-approved campaign.

We have been contacting affected Mastodon administrators, and are now moving to a public advisory to inform the broader network.

The network includes accounts impersonating reputable news outlets such as BBC News, Euronews, and Meduza, designed to give credibility to Telegram propaganda links. We believe it may be connected to the “[Pravda/Portal Kombat](https://www.sgdsn.gouv.fr/files/files/Publications/20240214_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_PART2_ENG_VF.pdf )” pro-Russia propaganda network.

Accounts are hosted across numerous Mastodon instances and bridged into Bluesky, creating the appearance of independent sources. Activity on Bluesky helped reveal aggregate patterns, identical usernames, posting schedules, and content themes more clearly than across decentralised Mastodon services.

This campaign appears to mimic tactics observed in earlier influence operations, blending low-cost automation with impersonation and volume-based amplification.

We are sharing data with participants of the [Social Web ISAC](https://connect.iftas.org/library/iftas-documentation/social-web-information-sharing-and-analysis-centre/ ), and we issued a [public advisory](https://mastodon.iftas.org/@iftas/115322867312262878 ) along with a [list of observed usernames](https://about.iftas.org/library/known-spam-fediverse-services/#Coordinated_Network_Spam_Accounts ).

We are aware of accounts hosted on abandoned or unmanaged services, we may issue a Limit recommendation for those domains at a later date.

If you provide or can link to tools that may benefit administrators in identifying and/or managing these accounts, please let us know.

**Further Reading:**
https://www.sgdsn.gouv.fr/files/files/20240212_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_ENG_VF.pdf">PORTAL KOMBAT A structured and coordinated pro-Russian propaganda network
https://www.sgdsn.gouv.fr/files/files/Publications/20240214_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_PART2_ENG_VF.pdf">PORTAL KOMBAT A structured and coordinated pro-Russian propaganda network (Part 2)
https://checkfirst.network/pravda-network-worldwide-expansion-and-llm-wikipedia-pollution/">“Pravda” Network: Worldwide Expansion and LLM, Wikipedia Pollution
https://www.americansunlight.org/updates/new-report-russian-propaganda-may-be-flooding-ai-models">Russian propaganda may be flooding AI models

"...to figure out what the new institutions that are needed ...

2026-04-23T15:56:14Z

In reply to nevent1q…aae0
_________________________

"...to figure out what the new institutions that are needed to build a better social internet actually look like. [...] And it seems that the main open question is: what will be the shape of the organisations that will actually build the future of the social internet?"

As always, excellent read. Thank you for your continued insights!

social.roadfm.fr is hosting 98 state-sponsored Russian propaganda ...

2026-04-23T15:38:03Z

social.roadfm.fr is hosting 98 state-sponsored Russian propaganda bots, Fediverse welcomes them!

I say welcomes because as the bot controllers know, the Fediverse blindly trusts every other Fediverse instance, bridge, anything that speaks ActivityPub - isn't that cool?

Free web hosting on thousands of hobbyist-run web sites around the world, such a great resource!

social.roadfm.fr is running in second place right now, only one other server that we know of has more of these bots.

cc wGaet (npub1l8q…mdhh)

Please see: ...

2026-04-23T05:30:45Z

In reply to nevent1q…0zlc
_________________________

Please see: https://about.iftas.org/library/suspected-portal-kombat-accounts/

quoting
note1fu6…dwr3

The Fediverse is increasingly used by state-sponsored disinformation and propaganda agents. We track accounts believed to be operated by the agencies and/or contractors, and we request account removals via reports, DMs, and email communications with affected service providers.

One particular activity is [believed to be the actions of the Portal Kombat network](https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/ ), aka “Pravda network”, which has created thousands of accounts on hundreds of servers.

Some providers do not remove these accounts when notified, therefore the accounts below represent a sample of what these accounts look like, what they post, how they present themselves. This may help admins and moderators in identifying these accounts, and identifying common IP addresses and MX records that can be used to flag or suspend new registrations from this network.

https://social.roadfm.fr/@akusa
https://social.roadfm.fr/@anyrum
https://social.roadfm.fr/@effiebryant
https://electroverse.tech/@concepcion_thiel
https://electroverse.tech/@jocelynsullivan
https://electroverse.tech/@ugiz
https://todon.ploud.fr/@bemelan
https://todon.ploud.fr/@cogegom
https://gs.leftic.club/@abiegh
https://gs.leftic.club/@Aeciva
https://gs.leftic.club/@Aeliphe
https://gs.leftic.club/@agachu
https://gs.leftic.club/@amaesho

⚠️ SW-ISAC Advisory The following domain(s) will be added to ...

2026-04-22T14:53:44Z

⚠️ SW-ISAC Advisory

The following domain(s) will be added to the IFTAS Abandoned/Unmanaged List on 2026-04-29:

iamveryti.red
m.pupu.moe

The following domain(s) are being escalated to the AUD process:

owo.town
social.datalabour.com

ref: https://docs.google.com/spreadsheets/d/1dsklopIabZOR6OkHrNS9mLnO5cfAZRbBoExD3sHowKY/edit?gid=1554967480#gid=1554967480

#SW_ISAC_ADVISORY #Spam #CIB #FIMI

There are currently 501 suspected accounts observed and active, ...

2026-04-21T21:57:49Z

In reply to nevent1q…vf7g
_________________________

There are currently 501 suspected accounts observed and active, on 101 ActivityPub domains. Of these, 149 have been reported.

There are likely many more, these are only the ones seen so far.

383 additional accounts have already been suspended.

social.datalabour.com is today's winner, with 104 accounts hosted.

170 suspected botnet accounts observed today. Too many to report ...

2026-04-21T21:23:33Z

170 suspected botnet accounts observed today. Too many to report manually.

#BotWatching

https://docs.google.com/spreadsheets/d/1dsklopIabZOR6OkHrNS9mLnO5cfAZRbBoExD3sHowKY/edit?gid=1554967480#gid=1554967480

this sounds like a very reasonable and effective emergency brake ...

2026-04-20T15:52:22Z

In reply to nevent1q…gg8l
_________________________

this sounds like a very reasonable and effective emergency brake for a runaway service.

My personal understanding of the issue is that Sujitech services ...

2026-04-20T15:45:20Z

In reply to nevent1q…upqy
_________________________

My personal understanding of the issue is that Sujitech services allow signing in with Google, Twitter, or Line, and updating will break that functionality - but this is only my best guess, I have no inside knowledge.

Nostr event nevent1qqsgn0c2cpntgef2yevg2n07vzg6wel8tw7jyqjyju3gep7jjegf5zgzyq3gdtdew4gt39ea5vkmdy2kzfhrkdax85txcxcy9gra3yu6yhqzqx294c9

2026-04-20T14:37:09Z

In reply to nevent1q…7wt0
_________________________

https://mastodon.iftas.org/@iftas/116437127273467746

quoting
note1psp…g5zm

#mastodadmin @fediadmin

For services considering defederating mastodon.cloud

Please be aware that account holders there are attempting to move their account, but this can take considerable time to complete, several days, especially for members with large follower counts.

Please consider Limiting the service while members attempting to move complete that action.

Suspending a service severs all relationships and is unrecoverable.

I have confirmed reports some account Move actions will take ...

2026-04-20T13:10:04Z

In reply to nevent1q…r4g4
_________________________

I have confirmed reports some account Move actions will take longer than 72 hours.

I recommend everyone take a breath and Limit the server if desired, and allow at least four weeks for members there to (a) hear they are being defederated and (b) have the time to move.

The phishing accounts have been suspended, there is some albeit limited response from Sujitech, and I am aware the service has no content policy and is overrun by bot spam (like many other services).

Additionally, be aware the mastodon.cloud moderators have ...

2026-04-20T12:59:32Z

In reply to nevent1q…6rf5
_________________________

Additionally, be aware the mastodon.cloud moderators have suspended the reported phishing accounts.

Many parties have reached out to Sujitech, and some actions have been taken by the service staff.

#mastodadmin @fediadmin For services considering defederating ...

2026-04-20T12:52:44Z

#mastodadmin @fediadmin

For services considering defederating mastodon.cloud

Please be aware that account holders there are attempting to move their account, but this can take considerable time to complete, several days, especially for members with large follower counts.

Please consider Limiting the service while members attempting to move complete that action.

Suspending a service severs all relationships and is unrecoverable.

thanks for the update!

2026-04-20T11:45:41Z

In reply to nevent1q…7ek4
_________________________

thanks for the update!

If social web providers wish to mitigate the traffic coming from ...

2026-04-19T15:06:13Z

In reply to nevent1q…pvwk
_________________________

If social web providers wish to mitigate the traffic coming from the service, "Limit" ing the service will reduce the unsolicited DM messages, I believe this flags incoming DMs as potentially spam (for Mastodon hosts).

Be aware there are many people using the service, and suspending the domain will sever all relationships.

Some phishing accounts have been suspended, so it's not ...

2026-04-19T14:28:41Z

In reply to nevent1q…5yap
_________________________

Some phishing accounts have been suspended, so it's not entirely abandoned.

mastodon.cloud is running Mastodon version 4.1.25 which went End Of Life 2025-04-08

The admin account last posted 2023-02-02

The service is open registration, provides no "About" details, and publishes no community rules.

There are 1,882 active members, although the bot ratio is higher than most servers for recent posts which are largely automated.

RE: https://union.place/@tim/116426691453325273 SW-ISAC Alert The ...

2026-04-18T17:48:27Z

RE: https://union.place/@tim/116426691453325273

SW-ISAC Alert

The Pro-Russian botnet is now using account invites to evade various mitigations in place.

Please review your invite codes, and who's allowed to use them.

ref: https://about.iftas.org/library/suspected-portal-kombat-accounts/
nostr:note1l6usqm9wg0t0h6982tfu9z5yczy7xc3uaz4xnunrd42l53arjp8qvhn79r

that's a quick turnaround from our reports, thank you!

2026-04-17T16:25:01Z

In reply to nevent1q…kj2u
_________________________

that's a quick turnaround from our reports, thank you!

let me think on that, it's a shared Google Doc but I'd ...

2026-04-17T15:19:44Z

In reply to nevent1q…c3mn
_________________________

let me think on that, it's a shared Google Doc but I'd need to allow editing on one or two tabs to make it work...

A list of the current database of accounts that are not yet known ...

2026-04-17T15:16:16Z

In reply to nevent1q…eptp
_________________________

A list of the current database of accounts that are not yet known to be suspended or flagged as false positives:

https://docs.google.com/spreadsheets/d/1dsklopIabZOR6OkHrNS9mLnO5cfAZRbBoExD3sHowKY

I'd love to automate some of this so we can simply report an ...

2026-04-17T15:02:57Z

In reply to nevent1q…hzf3
_________________________

I'd love to automate some of this so we can simply report an account URL and have the report created with the relevant service and then track the account. I have to manually load each account daily to see if it's been removed.

But yeah, I am running out of hours in the day to deal with this on top of all the other stuff needs doing.

and the previous batch before the IOCs changed: ...

2026-04-17T14:58:22Z

In reply to nevent1q…jvz9
_________________________

and the previous batch before the IOCs changed:

Nostr event nevent1qqspjd97uuwc4xda5r962suz4l7t92jna9rd4fes9qmny7kk4jz6n4czyq3gdtdew4gt39ea5vkmdy2kzfhrkdax85txcxcy9gra3yu6yhqzq53ux78

2026-04-17T14:16:40Z

In reply to nevent1q…aex2
_________________________

you know what, sure, here's a subset of the list, minus any ...

2026-04-17T14:12:11Z

In reply to nevent1q…6cj9
_________________________

you know what, sure, here's a subset of the list, minus any we know have been suspended or the server was taken offline - New means it hasn't been classified yet

https://docs.google.com/spreadsheets/d/1dsklopIabZOR6OkHrNS9mLnO5cfAZRbBoExD3sHowKY/edit?gid=1926542286#gid=1926542286

it's this group: ...

2026-04-17T13:58:44Z

In reply to nevent1q…cmlz
_________________________

it's this group: https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/

quoting
note1rs0…97et

Indicators of compromise (IOCs) that identify accounts as likely being part of the network include:
a single follow (the bsky.brid.gy @ bsky.brid.gy account), or first follow is the bridge
followers and following hidden from public
registration after September 8, 2025
linking to pro-Russia Telegram channels, or Russian news sources
posts that cut off mid-sentence
masquerading as legitimate news organisations
disposable email domains used for the account registration

The accounts are created and left alone for a short period, and will have no posts for up to week, sometimes more.

Once in use, the account will likely follow a dozen or so accounts on servers that are listed on the [AUD Denylist](https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/ ).

*Update November 21: with over 750 accounts and growing, we will no longer be updating the daily accounts tracker and instead will be focussing on identifying the domains known to be wholly unmanaged or unmaintained, please see the [IFTAS Abandoned and Unmanaged Domain (AUD) Denylist](https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/ ) page for more details.*

*Update October 25: Accounts are still being created (571 observed so far), and a number of servers are either unwilling or unresponsive in removing these accounts. A list of servers recommended for limiting or defederating is now available at https://about.iftas.org/library/known-spam-fediverse-services/#Unmanaged_Unmaintained_Abandoned_Servers*

*Update October 14: Accounts are still being created, and unused accounts registered earlier are being activated.*

Since 15 September, IFTAS has been tracking a coordinated network of over 300 accounts operating across Mastodon. These accounts are engaged in a high-volume propaganda campaign, promoting pro-Russian narratives and linking to Telegram channels associated with known state-aligned disinformation operations.

We became aware of a related investigation by the [Antibot4Navalny](https://bsky.app/profile/antibot4navalny.bsky.social ) research team that observed these accounts bridging to Bluesky, and we have since collaborated to enhance our investigations and share our findings. Their [public post](https://bsky.app/profile/antibot4navalny.bsky.social/post/3m22256476k25 ) provides further context.

Antibot4Navalny’s observations identified additional impacted services we were unaware of, and highlighted that accounts were still being created. Furthermore, thanks to their specific expertise in this area, this helped clarify and confirm that what we were seeing was indeed the work of a coordinated campaign with an increased likelihood of it being a state-sponsored or state-approved campaign.

We have been contacting affected Mastodon administrators, and are now moving to a public advisory to inform the broader network.

The network includes accounts impersonating reputable news outlets such as BBC News, Euronews, and Meduza, designed to give credibility to Telegram propaganda links. We believe it may be connected to the “[Pravda/Portal Kombat](https://www.sgdsn.gouv.fr/files/files/Publications/20240214_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_PART2_ENG_VF.pdf )” pro-Russia propaganda network.

Accounts are hosted across numerous Mastodon instances and bridged into Bluesky, creating the appearance of independent sources. Activity on Bluesky helped reveal aggregate patterns, identical usernames, posting schedules, and content themes more clearly than across decentralised Mastodon services.

This campaign appears to mimic tactics observed in earlier influence operations, blending low-cost automation with impersonation and volume-based amplification.

We are sharing data with participants of the [Social Web ISAC](https://connect.iftas.org/library/iftas-documentation/social-web-information-sharing-and-analysis-centre/ ), and we issued a [public advisory](https://mastodon.iftas.org/@iftas/115322867312262878 ) along with a [list of observed usernames](https://about.iftas.org/library/known-spam-fediverse-services/#Coordinated_Network_Spam_Accounts ).

We are aware of accounts hosted on abandoned or unmanaged services, we may issue a Limit recommendation for those domains at a later date.

If you provide or can link to tools that may benefit administrators in identifying and/or managing these accounts, please let us know.

**Further Reading:**
https://www.sgdsn.gouv.fr/files/files/20240212_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_ENG_VF.pdf">PORTAL KOMBAT A structured and coordinated pro-Russian propaganda network
https://www.sgdsn.gouv.fr/files/files/Publications/20240214_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_PART2_ENG_VF.pdf">PORTAL KOMBAT A structured and coordinated pro-Russian propaganda network (Part 2)
https://checkfirst.network/pravda-network-worldwide-expansion-and-llm-wikipedia-pollution/">“Pravda” Network: Worldwide Expansion and LLM, Wikipedia Pollution
https://www.americansunlight.org/updates/new-report-russian-propaganda-may-be-flooding-ai-models">Russian propaganda may be flooding AI models

The actors in question are monitoring our activity, so we are ...

2026-04-17T13:06:33Z

In reply to nevent1q…6cj9
_________________________

The actors in question are monitoring our activity, so we are limited on what we can share publicly. We have a private group that shares observations, we work with various bot detector groups, numerous admins, and we reach out directly to impacted services with our observations and guidance on mitigating these account creations.

If admins are unresponsive or outright refuse to review these accounts, they are then considered for the Abandoned/Unmanaged list.

https://about.iftas.org/library/suspected-portal-kombat-accounts/

quoting
note1fu6…dwr3

The Fediverse is increasingly used by state-sponsored disinformation and propaganda agents. We track accounts believed to be operated by the agencies and/or contractors, and we request account removals via reports, DMs, and email communications with affected service providers.

One particular activity is [believed to be the actions of the Portal Kombat network](https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/ ), aka “Pravda network”, which has created thousands of accounts on hundreds of servers.

Some providers do not remove these accounts when notified, therefore the accounts below represent a sample of what these accounts look like, what they post, how they present themselves. This may help admins and moderators in identifying these accounts, and identifying common IP addresses and MX records that can be used to flag or suspend new registrations from this network.

https://social.roadfm.fr/@akusa
https://social.roadfm.fr/@anyrum
https://social.roadfm.fr/@effiebryant
https://electroverse.tech/@concepcion_thiel
https://electroverse.tech/@jocelynsullivan
https://electroverse.tech/@ugiz
https://todon.ploud.fr/@bemelan
https://todon.ploud.fr/@cogegom
https://gs.leftic.club/@abiegh
https://gs.leftic.club/@Aeciva
https://gs.leftic.club/@Aeliphe
https://gs.leftic.club/@agachu
https://gs.leftic.club/@amaesho

Observed on 77 domains so far, eg ...

2026-04-17T13:00:48Z

In reply to nevent1q…wxw7
_________________________

Observed on 77 domains so far, eg

https://electroverse.tech/directory?local=true&order=new
https://darmstadt.social/directory?local=true&order=new
https://h4.io/directory?local=true&order=new
https://imastodon.blue/directory?local=true&order=new
https://mast.qixto.com/directory?local=true&order=new
https://todon.ploud.fr/directory?local=true&order=new
https://wehavecookies.social/directory?local=true&order=new

...and deeply fingerstache.

2026-04-17T12:58:49Z

In reply to nevent1q…zr8z
_________________________

...and deeply fingerstache.

The following domains have open registration, are being overrun ...

2026-04-17T12:51:27Z

The following domains have open registration, are being overrun by coordinated LLM bot spam, and are unresponsive to outreach requesting account reviews or refuse to remove these accounts.

These may be added to the Abandoned/Unmanaged Denylist. Anyone with opportunity to help alert these admins please do so.

https://iamveryti.red/directory?local=true&order=new
https://imastodon.blue/directory
https://h4.io/directory?local=true&order=new
https://zirk.us/directory?local=true&order=new
https://mastodon.lithium03.info/directory?local=true&order=new
https://organica.social/directory?local=true&order=new
https://wehavecookies.social/directory?local=true&order=new

#SPAM #CIB #FIMI

zirk.us is being overrun by LLM-powered bot spam. The admin has ...

2026-04-16T18:30:22Z

zirk.us is being overrun by LLM-powered bot spam. The admin has not posted since January 2025.

If anyone has a way to reach anyone there, please let me know, emails have gone unanswered.

ref: https://zirk.us/directory?local=true&order=new

Service shutdown notice: med-mastodon.com closed April 6th, 2026 ...

2026-04-16T12:28:21Z

Service shutdown notice:

med-mastodon.com closed April 6th, 2026

https://mastodonapp.uk/@wild1145/116328976466080884

quoting
note1cut…t8za

Just to say, I'm now suspending any #MedMastodon accounts which are still actively posting. The actual cut off when hosting will stop should be the 5th / 6th by the looks of it so there is still some time to migrate accounts.

Any accounts suspended can appeal the suspension if they want to migrate their relationships and I'll get the account restored.

I'll move my Med-Mastodon account in the next couple of days as well.

Service shutdown notice: augsburg.social closed April 1, 2026. If ...

2026-04-15T14:42:30Z

Service shutdown notice:

augsburg.social closed April 1, 2026.

If anyone has information on the status of the following servers, please let us know:

mastouille.fr
sbg-social.at
social.up.edu.ph

Nostr event nevent1qqsyn9s7jvhh4m8mqjdnk0s3wme6qdr7pq729556dcwesm3nqu4crqszyq3gdtdew4gt39ea5vkmdy2kzfhrkdax85txcxcy9gra3yu6yhqzqjgddar

2026-04-14T14:35:34Z

In reply to nevent1q…t5cr
_________________________

https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/

quoting
note1rs0…97et

Indicators of compromise (IOCs) that identify accounts as likely being part of the network include:
a single follow (the bsky.brid.gy @ bsky.brid.gy account), or first follow is the bridge
followers and following hidden from public
registration after September 8, 2025
linking to pro-Russia Telegram channels, or Russian news sources
posts that cut off mid-sentence
masquerading as legitimate news organisations
disposable email domains used for the account registration

The accounts are created and left alone for a short period, and will have no posts for up to week, sometimes more.

Once in use, the account will likely follow a dozen or so accounts on servers that are listed on the [AUD Denylist](https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/ ).

*Update November 21: with over 750 accounts and growing, we will no longer be updating the daily accounts tracker and instead will be focussing on identifying the domains known to be wholly unmanaged or unmaintained, please see the [IFTAS Abandoned and Unmanaged Domain (AUD) Denylist](https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/ ) page for more details.*

*Update October 25: Accounts are still being created (571 observed so far), and a number of servers are either unwilling or unresponsive in removing these accounts. A list of servers recommended for limiting or defederating is now available at https://about.iftas.org/library/known-spam-fediverse-services/#Unmanaged_Unmaintained_Abandoned_Servers*

*Update October 14: Accounts are still being created, and unused accounts registered earlier are being activated.*

Since 15 September, IFTAS has been tracking a coordinated network of over 300 accounts operating across Mastodon. These accounts are engaged in a high-volume propaganda campaign, promoting pro-Russian narratives and linking to Telegram channels associated with known state-aligned disinformation operations.

We became aware of a related investigation by the [Antibot4Navalny](https://bsky.app/profile/antibot4navalny.bsky.social ) research team that observed these accounts bridging to Bluesky, and we have since collaborated to enhance our investigations and share our findings. Their [public post](https://bsky.app/profile/antibot4navalny.bsky.social/post/3m22256476k25 ) provides further context.

Antibot4Navalny’s observations identified additional impacted services we were unaware of, and highlighted that accounts were still being created. Furthermore, thanks to their specific expertise in this area, this helped clarify and confirm that what we were seeing was indeed the work of a coordinated campaign with an increased likelihood of it being a state-sponsored or state-approved campaign.

We have been contacting affected Mastodon administrators, and are now moving to a public advisory to inform the broader network.

The network includes accounts impersonating reputable news outlets such as BBC News, Euronews, and Meduza, designed to give credibility to Telegram propaganda links. We believe it may be connected to the “[Pravda/Portal Kombat](https://www.sgdsn.gouv.fr/files/files/Publications/20240214_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_PART2_ENG_VF.pdf )” pro-Russia propaganda network.

Accounts are hosted across numerous Mastodon instances and bridged into Bluesky, creating the appearance of independent sources. Activity on Bluesky helped reveal aggregate patterns, identical usernames, posting schedules, and content themes more clearly than across decentralised Mastodon services.

This campaign appears to mimic tactics observed in earlier influence operations, blending low-cost automation with impersonation and volume-based amplification.

We are sharing data with participants of the [Social Web ISAC](https://connect.iftas.org/library/iftas-documentation/social-web-information-sharing-and-analysis-centre/ ), and we issued a [public advisory](https://mastodon.iftas.org/@iftas/115322867312262878 ) along with a [list of observed usernames](https://about.iftas.org/library/known-spam-fediverse-services/#Coordinated_Network_Spam_Accounts ).

We are aware of accounts hosted on abandoned or unmanaged services, we may issue a Limit recommendation for those domains at a later date.

If you provide or can link to tools that may benefit administrators in identifying and/or managing these accounts, please let us know.

**Further Reading:**
https://www.sgdsn.gouv.fr/files/files/20240212_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_ENG_VF.pdf">PORTAL KOMBAT A structured and coordinated pro-Russian propaganda network
https://www.sgdsn.gouv.fr/files/files/Publications/20240214_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_PART2_ENG_VF.pdf">PORTAL KOMBAT A structured and coordinated pro-Russian propaganda network (Part 2)
https://checkfirst.network/pravda-network-worldwide-expansion-and-llm-wikipedia-pollution/">“Pravda” Network: Worldwide Expansion and LLM, Wikipedia Pollution
https://www.americansunlight.org/updates/new-report-russian-propaganda-may-be-flooding-ai-models">Russian propaganda may be flooding AI models

great work describing all the thought and care you've put in ...

2026-04-14T13:49:27Z

In reply to nevent1q…6xz6
_________________________

great work describing all the thought and care you've put in to the service in the form of a federation policy!

IFTAS believes every federating service should have one, learn more about federation policies at https://about.iftas.org/library/example-federation-policies/

Example accounts have been updated: ...

2026-04-13T15:26:32Z

In reply to nevent1q…x5l3
_________________________

Example accounts have been updated:

https://social.roadfm.fr/@akusa
https://social.roadfm.fr/@anyrum
https://social.roadfm.fr/@effiebryant
https://mastodon.lithium03.info/@carolynpalmer
https://mastodon.lithium03.info/@czm2spy
https://mastodon.lithium03.info/@emily-gordon
https://electroverse.tech/@concepcion_thiel
https://electroverse.tech/@jocelynsullivan
https://electroverse.tech/@ugiz
https://todon.ploud.fr/@bryanadavies
https://todon.ploud.fr/@duwa_ury
https://todon.ploud.fr/@ezomo
https://gs.leftic.club/@aji_roti
https://gs.leftic.club/@Okem_Gecyj
https://gs.leftic.club/@VioletQuinn

#FediAdmin #MastoAdmin #FIMI #Disinformation #Spam

The open-registration domain in question was observed as allowing ...

2026-04-04T17:56:47Z

In reply to nevent1q…clam
_________________________

The open-registration domain in question was observed as allowing spammers and pro-Russian disinformation contractors in November 2025. Repeated attempts to contact the administrator via email (bounced) and direct message were ignored. The observed accounts are still active, we stopped tracking them in February and added the domain to AUD, there may be more now. Any request to remove the domain from the list must come from admin.

purely an FYI, not a call for any action but in case you're ...

2026-03-31T17:33:06Z

In reply to nevent1q…lss4
_________________________

purely an FYI, not a call for any action but in case you're interested - a number of your top ten content sources are known spam services, more info here: https://about.iftas.org/library/known-spam-fediverse-services/

If you haven't blocked the root domain at Hugging Face ...

2026-03-09T17:39:39Z

In reply to nevent1q…37ad
_________________________

If you haven't blocked the root domain at Hugging Face (hf.space) be aware there is new Pleroma-based activity coming from

saly125-a.hf.space

hf.space is a hosting service for "AI Apps" and is ...

2026-03-05T09:07:10Z

hf.space is a hosting service for "AI Apps" and is currently being used to generate large amounts of #Spam on federated networks. The subdomain seen in use is ali525-q.hf.space - however, numerous spam activities are paused, running, or being stopped by HuggingFace and at this time we recommend suspending federation with the hf.space domain entirely.

ref: https://huggingface.co/ali525/spaces

to report the HF user see https://huggingface.co/content-policy

please untag me from this portion of the thread

2026-02-26T18:29:50Z

In reply to nevent1q…zem9
_________________________

please untag me from this portion of the thread

⚠️ SW-ISAC Advisory The IFTAS Do Not Interact domain denylist ...

2026-02-26T18:19:05Z

⚠️ SW-ISAC Advisory

The IFTAS Do Not Interact domain denylist has been updated.

This newly added domain(s) are identified as federating TVEC and explicit content based on human review.

If your service imports the IFTAS DNI denylist, please update accordingly.

https://about.iftas.org/library/iftas-dni-list/

#SW_ISAC_Advisory #TVEC #ExplicitContent

Thanks to our community, these labels and their definitions are ...

2026-02-25T22:13:03Z

In reply to nevent1q…f342
_________________________

Thanks to our community, these labels and their definitions are also available in other languages. Special thanks to DTSP for re-releasing these labels as Creative Commons, allowing us to solicit translation volunteers.

Français
Português Brasileiro
Scots Gaelic (labels only)
简体字 (Simplified Chinese)

No, I don't see that. I see that in tightly constrained ...

2026-02-25T21:43:38Z

In reply to nevent1q…q0wt
_________________________

No, I don't see that. I see that in tightly constrained timelines of mutual follows, but I don't see it on fedi writ large.

We are all prisoners of our own chronological bubbles.

Run a few accounts on a few different servers on a few different platforms with a few different denylists, or none.

I'm not saying it fails to deal with anything at all, from ...

2026-02-25T21:27:06Z

In reply to nevent1q…yxyc
_________________________

I'm not saying it fails to deal with anything at all, from your perspective, for your needs. There are a million fediverses, you get to do whatever you want with yours.

it only conflicts if you want to pressure other people to take ...

2026-02-25T21:13:42Z

In reply to nevent1q…6qqr
_________________________

it only conflicts if you want to pressure other people to take your approach. You get to do it your way. 40,000 other people get to do it their way.

And I'll add, not all activities need to be reactive, some proactive steps can be helpful, including blocking known bad actors.

im personally a proponent of a standard list so we can share ...

2026-02-25T20:38:42Z

In reply to nevent1q…lx87
_________________________

im personally a proponent of a standard list so we can share lists. If I share a list with undefined labels, who would ingest it? We have more moderators than Twitter, but without a shared vocabulary we cannot coordinate, collaborate, communicate

I'm biased, we use industry standard terms available under ...

2026-02-25T20:33:19Z

In reply to nevent1q…8kct
_________________________

I'm biased, we use industry standard terms available under creative commons. These are not IFTAS labels btw, these are DTSP labels.

I was there for the 90s. We are not in that. We are in an ...

2026-02-25T20:28:39Z

In reply to nevent1q…22uj
_________________________

I was there for the 90s. We are not in that. We are in an interconnected world of 40,000 services sending copies of their content to be stored and hosted by their peers. Some of this content is illegal in most countries. Some of it has caused severe harm to people I've worked with as they melt down. Some of it is appropriate for a given community, some of it is not. Some of it is regulated by some of the countries so e of these services are located in. Welcome to the 2020s.

I disagree. The only servers that should be blocked are those ...

2026-02-25T19:58:55Z

In reply to nevent1q…3w68
_________________________

I disagree. The only servers that should be blocked are those that the operator of the service exposing themselves to the responsibilities and liabilities of hosting user generated content wish to block. Everyone gets to make their decisions, for themselves or for their community. Not me. Not you. Them.

Federation is a privilege, not a right.

let's talk about labels, I believe any nextgen ingestion ...

2026-02-25T19:40:41Z

In reply to nevent1q…nhnk
_________________________

let's talk about labels, I believe any nextgen ingestion should use the shared vocabulary to take in blocks by label https://about.iftas.org/library/shared-vocabulary-labels/

Maybe you want to block CSAM, but don't care about copyright infringement... (This way we could run one list instead of five and you choose the harms you want to block, as everything is labelled)

I also believe platforms that offer a "flagship" server ...

2026-02-25T19:37:17Z

In reply to nevent1q…8vh8
_________________________

I also believe platforms that offer a "flagship" server should make /their/ denylist available at install, after all, they know a lot more about what they're seeing on the platform than anyone else. "We block these servers, you might want to, too'

/me whispers "independent"

2026-02-25T19:33:01Z

In reply to nevent1q…2a4x
_________________________

/me whispers "independent"

WordPress and BridgyFed offer it as a default option, would love ...

2026-02-25T19:32:32Z

In reply to nevent1q…l0kw
_________________________

WordPress and BridgyFed offer it as a default option, would love to see more platforms educating their admins as to the basic why-you-might-want-a-denylist and offering recommended options.

⚠️ SW-ISAC Advisory The following domain(s) have been added ...

2026-02-23T18:09:06Z

⚠️ SW-ISAC Advisory

The following domain(s) have been added to the IFTAS Abandoned/Unmanaged List:

social.5th.ro
tty0.social

The following domains are being escalated to the watchlist:

iamveryti.red

https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/

#SW_ISAC_ADVISORY

there's a lot, it's everywhere, and it's growing.

2026-02-20T17:37:55Z

In reply to nevent1q…llje
_________________________

there's a lot, it's everywhere, and it's growing.

Really happy to see a focus on safety in this new blog post from ...

2026-02-18T19:53:26Z

Really happy to see a focus on safety in this new blog post from the Mastodon (npub163h…mv0n) team

https://blog.joinmastodon.org/2026/02/connecting-the-world-through-thriving-online-communities/