← Feed
@christin@lsbt.me
2026-09-17 04:57 UTC
Quick heads-up for other Mastodon admins: this registration spam wave isn't over yet.
On lsbt.me, we first saw a flood of API registrations using Python/aiohttp. The telltale signs were usernames following the pattern bp plus 16 hex characters, and the sign-up reason was always "Automated protocol deliverability probe". A narrow block on that user agent stopped the first wave.
Today, however, five new registrations came in with the same usernames and the same sign-up reason. This time the bot simply identified itself as Chrome 126. That's exactly why a user agent is only useful as a short-term filter. It's a header the client can set to anything.
The requests go to POST /api/v1/accounts. This endpoint lets client apps create a new local account directly in the app. No app needs it for OAuth connections to existing accounts. #FediSuite doesn't use it either. It registers itself via /api/v1/apps, obtains consent via /oauth/authorize, and then works with a user token. Regular sign-up through the Mastodon website is also handled separately via POST /auth.
So I've completely disabled API account creation on lsbt.me. Web sign-up, OAuth, and existing clients keep working as before. Anyone who wants a new account just signs up once on the web as usual and can then use any client.
If you'd also rather not offer this optional native sign-up path, you can add the following to your Nginx server block, before the general location / block. The example assumes the @proxy location that many Mastodon Nginx configs already include:
location = /api/v1/accounts {
limit_except GET {
deny all;
}
try_files $uri @proxy;
}
This returns a 403 only for POST /api/v1/accounts. The read-only GET endpoint remains reachable. As always, run nginx -t afterwards and only reload once the test passes.
#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub
Replies (5)
-
@christin@lsbt.me for those sensible people that use Caddy, here's the config snippet for that:
```
@apiacct {
path /api/v1/accounts
not method GET
}
handle @apiacct {
respond "Go stick your head in a pig" 403
}
```
#mastodon #fediverse #mastoadmin
Open ##4742758
-
@christin@lsbt.me Thank you for sharing!
Open ##5087049
-
@christin@lsbt.me That does mean people have to use the web client to register an account, right?
So someone can't, for example, download the Mastodon mobile app, having never had an account before, fire it up and say "Create Account"? That won't work if they then pick your server?
Note: I don't know if this is actually possible via the Mastodon mobile app, since I don't use it. But I would imagine they would want to make something like that available. :-)
Open ##5087050
-
@christin@lsbt.me FYI we saw one (just one, interestingly) of these signups reference sendflood [ dot ] com which appears to be a "we'll flood someone's inbox for you for pay" kind of malicious site, which is even ickier than the other thoughts I've seen about what it might be.
We've closed registrations entirely right now to avoid being an amplification vector, this looks to be a potential nasty arms race. :(
Open ##5087052
-
@christin@lsbt.me Er, have I mentioned https://github.com/scottgal/stylobot ? It's a behavioral filter, rather than a static one.
Open ##5087056