The current spam wave originates at I have confirmed with another admin that this IP seems to be stable at least for today's spam.

They have selected instances via in the past, so if you're listed there you might be more at risk.

You can stop it for now by adding `deny;` to the server block in your nginx config.

@aurelia Good catch. I'm working on an automoderator; once I get it working better I'm gonna try to add an IP rule which checks the poster's IP.

Additionally, the two site IPs being used so far are and; useful if they decide to start hopping domains.

@bclindner This originates at Flokinet IS, a "bulletproof" host associated with known right-wing troll Vincent Canfield of fame. Recommend blocking their entire AS. This is shared hosting at 1and1, I've already contacted their abuse desk.

@bclindner The Floki IP specifically originates at, there is no chance at that being moderated (I unfortunately know Vincent and know how he ticks)

@aurelia Looks like Eugen is finally getting around to it too, now that the crisis has forced his hand.

@KitsuneAlicia "crysis has forced his hand" is a bit of a dramatisation, I asked for it to be reprioritized and that was about it

@aurelia Well, the spambot, while not a new phenomenon, has seen quite the uptick since this asshole decided to do what he's doing, so even if "crisis" is a bit overkill, it's still pretty accurate.

@koyu AFAIK the IPs keep changing, I got reports from several different IPs without any valid pattern I could detect:


@aurelia Got another IP for you if you're interested - got a persistent spammer today from You got anything on that IP?

Sign in to participate in the conversation
Serenity Laboratories

Welcome to the Serenity Laboratories public Mastodon instance. This is a stable instance with high standards of curation and moderation. Please read those before registering. The short version is: No Nazis. No Fascists. No bigotry. Listen and be excellent to other people.