this post was submitted on 08 Apr 2025
453 points (99.3% liked)

Fediverse

32677 readers
370 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).

If you wanted to get help with moderating your own community then head over to [email protected]!

Rules

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)

founded 2 years ago
MODERATORS
 

The attacker seems to be the admin of those two instances. Both instances have their registrations closed.

Edit: It is now open for both of them, or was already. I checked the Fediseer page for both instances and it still says that their registrations are closed.

Though it is suspicious that no captcha, email confirmation or manual approval is required for both of these instances. The admin of lemmy.doesnotexist.club seems to be inactive since their account creation yet this instance is still running. If the admin is the attacker, it could also be that they are the one behind the recent nicole spam.

https://gui.fediseer.com/instances/detail/chinese.lol

https://gui.fediseer.com/instances/detail/lemmy.doesnotexist.club

cross-posted from: https://hackertalks.com/post/8713785

The instances being used are

  • lemmy.doesnotexist.club
  • chinese.lol

Here is an example of the coordinated downvoting https://hackertalks.com/post/8692093

Of course its a controversial user who got someone angry enough to automated downvoting @[email protected]

But you can see every post they make gets 53ish downvotes from these two instances, plus some organic ones after a few hours.

Current downvoting Accounts

bot-list

[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]

A individual user airing their personal biases and manipulating lemmy isn't good for the community, regardless of how you feel about their target. This is a really bad thing (tm)

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 11 points 1 week ago (3 children)

Beats me what anybody would get out of vote manipulation on lemmy - there are no sponsors, no money involved AFAIK. What's the payoff, upvotes?

[–] [email protected] 5 points 6 days ago

Pettiness. I guess some people suffer from such extreme grass deficiency that they'll go through all the trouble of setting up bots to do fully automated luxury harassment instead of small-batch hand-raised harassment.

[–] [email protected] 3 points 6 days ago (2 children)

The person being downvoted is the mod of c/conservative. I'm guessing this is a political maneuver to bury his posts/bully him off lemmy

[–] [email protected] 1 points 6 days ago

Which one, because all of them have been rightfully conquered for the proletariat other than whatever Universal Monk is getting up to

[–] [email protected] 4 points 6 days ago

We don't need bots to do that!

[–] [email protected] 3 points 6 days ago

Winning the hearts and minds in a propaganda / information war at relatively low cost

[–] [email protected] 46 points 1 week ago (6 children)

Seems relatively painless to chop those two instances off - chinese.lol has less than 200 users, and I can't even find instance info for doesnotexist.club (coincidence? i think NOT).

I do personally wonder how difficult it is to spin up new instances though. How much effort would it be for them to create a new one and do it again?

I'm actually most concerned with the IP leaking of the fediverse chick posts - hopefully some progress has been made with the IP leaking in auto-loaded external media through DM's

[–] [email protected] 5 points 6 days ago (1 children)

How much effort would it be for them to create a new one and do it again?

Minimal, but it is the domain that gets blocked so the attacker would still need to purchase a new domain.

[–] [email protected] 1 points 3 days ago

Not with sub domains.

[–] [email protected] 1 points 1 week ago

That's what I'm afraid of. Once some bad actors realize Lemmy is as defenseless as it is, it'll be carnage for a while. The only tool we have is defederation and it's slow and borderline useless against spam or worse.

[–] [email protected] 2 points 1 week ago (1 children)

I’m actually most concerned with the IP leaking

I'm curious, what is it about IP leaking that concerns you? I've been thinking about it lately but I have a hard time seeing why it's a problem.

[–] [email protected] 2 points 6 days ago

For one, you now know there is someone on the other end, so you can target your attacks instead of trying random ips.

[–] [email protected] 1 points 1 week ago

fairly low effort but annoying like one click with yunohost

[–] [email protected] 5 points 1 week ago* (last edited 1 week ago)

I checked the images and so far every image I've encountered linked to the users's lemmy instance's pictrs instance, none were hosted through a custom trackable image host.

[–] [email protected] 17 points 1 week ago

Some instances enable the image proxy, which should prevent this.

load more comments
view more: next ›