Well this is concerning.

[anticomposite@wikis.world]

RE: https://mastodon.iftas.org/@iftas/116426965511875330

@Viss @leo the current tactic seems to be getting a legit-looking account through review, then using invites (which bypass review) to create the spam accounts.

[viss@mastodon.social]

@anticomposite @leo oh interesting - you think there are approved accounts already in there that are farming invites out to the bots?

[ariarhythmic@ohai.social]

@leo Are existing members allowed to create invites that bypass review?

[serge@babka.social]

@leo

How did they circumvent your manual process?

[god@tlv.cool]

@leo concerning is an understatement here, Leo.

[hamishtpb@mewblog.thepolarbear.co.uk]

@leo Can I confirm - this is on Mastodon's server software?

[scattapilla@jorts.horse]

@leo looking at the account in modtools should say the inviter name, just ban them too

[curiously@mastodon.au]

@leo hey thanks for your work in finding and removing these bots. Much appreciated the horde of admins across the Fediverse do an awesome job keeping this a safe place that's people first. Thank you.

[oregon_pacifist@retro-gaiden.com]

@leo yeah, there was a wave of bots that joined my instance. Enabling Captcha didn’t slow them down at all. The only thing that helped was requiring new accounts to write a reason to join. Haven’t seen a bot since.

[brothercasas@twit.social]

@leo thanks for keeping this server safe.

[roryh@twit.social]

@leo thanks for putting in the effort to keep this instance clean!

[beet1123@twit.social]

@leo ims i had to give a reason to join

[oli@olifant.social]

@ariarhythmic @leo This is how it's being done by the 'Portal Kombat' crew. They use existing accounts and use server invites to bypass registration checks.

[iveyline@mastodon.nz]

@curiously @leo Yes, thanks a million. It is really appreciated.

[nihilistic_capybara@layer8.space]

@leo aren't traditional capchas kind of a solved problem in machine learning?

[evan@cosocial.ca]

@leo thanks for keeping vigilant, Leo!