<![CDATA[I've noticed a very slow trickle of fake accounts registering at my instance recently.]]>I've noticed a very slow trickle of fake accounts registering at my instance recently. They put more work into them than normal:

- they have somewhat convincing usernames
- semi-reasonable descriptions
- emails on custom domains (Hetzner vps usually)
- unique IP per account (often same subnet)
- uploads a profile pic & banner image
- some of them boost a few posts from admin acct

But then these accounts just sit there. They aren't spamming. What is their goal?

]]>https://forum.fedi.dk/topic/15ab2718-f2a0-4a30-9fbd-b20a75a5e9a0/i-ve-noticed-a-very-slow-trickle-of-fake-accounts-registering-at-my-instance-recently.RSS for NodeWed, 13 May 2026 16:08:54 GMTWed, 22 Apr 2026 15:31:38 GMT60<![CDATA[Reply to I've noticed a very slow trickle of fake accounts registering at my instance recently. on Wed, 22 Apr 2026 19:43:38 GMT]]>@sb

I've noticed similar accounts commenting on YouTube.

They have been created years ago with minimal information, and suddenly they come out and go full throttle with pro-Russian arguments in debates on videos related to the US, EU and Ukraine.

It's not ideal that Hetzner is hosting the email for them, but then again - if the Hetzner account is created by a EU citizen with Russian ties, it's almost impossible to detect.

Personally I would contact the account owner and ask them a couple of follow-up questions and tell them to go elsewhere if I felt something was fishy.

]]>https://forum.fedi.dk/post/https://social.vivaldi.net/users/madsenandersc/statuses/116450067631615988https://forum.fedi.dk/post/https://social.vivaldi.net/users/madsenandersc/statuses/116450067631615988Wed, 22 Apr 2026 19:43:38 GMT<![CDATA[Reply to I've noticed a very slow trickle of fake accounts registering at my instance recently. on Wed, 22 Apr 2026 17:01:25 GMT]]>@sb
This sounds similar to a bot campaign which has recently unfolded on a number of instances including ours. They can talk their way through a manual signup review, leading some to think humans initiate the accounts. The Kolektiva bots initially boosted a few toots from local accounts. They post squalls of stochastic automated text, first in English, and then switching to Greek (!). They also post slop graphics. A thematic that emerges through the nonsense is clear, a focus on the Ukraine war which is derogatory to Ukrainians. IOW, actual Russian bots

]]>https://forum.fedi.dk/post/https://kolektiva.social/users/ophiocephalic/statuses/116449429784947902https://forum.fedi.dk/post/https://kolektiva.social/users/ophiocephalic/statuses/116449429784947902Wed, 22 Apr 2026 17:01:25 GMT<![CDATA[Reply to I've noticed a very slow trickle of fake accounts registering at my instance recently. on Wed, 22 Apr 2026 16:31:59 GMT]]>@sb

Sounds like sleeper bot accounts.

They're most likely monitoring your public instance feed, including non-federated instance-local-only posts as I noticed some aren't following other accounts, but check if an account is following them.

I'd also check for any unexpected traffic to/from your instance on the wire when there shouldn't be any, just in case.

But it's concerning.

]]>https://forum.fedi.dk/post/https://corteximplant.com/users/synnfynn/statuses/116449314077770077https://forum.fedi.dk/post/https://corteximplant.com/users/synnfynn/statuses/116449314077770077Wed, 22 Apr 2026 16:31:59 GMT<![CDATA[Reply to I've noticed a very slow trickle of fake accounts registering at my instance recently. on Wed, 22 Apr 2026 16:24:52 GMT]]>@sb definitely will be used later. Had that happen here, they’d look legit for a while then start spamming. Luckily recently for me all of the spam signups have been pretty dang obvious.

]]>https://forum.fedi.dk/post/https://opencoaster.net/users/troy/statuses/116449286075263781https://forum.fedi.dk/post/https://opencoaster.net/users/troy/statuses/116449286075263781Wed, 22 Apr 2026 16:24:52 GMT<![CDATA[Reply to I've noticed a very slow trickle of fake accounts registering at my instance recently. on Wed, 22 Apr 2026 15:59:13 GMT]]>@sb
Possibly data harvesting while waiting for some command?

I think IFTAS had a post quite recently about a whole botnet that's creating tons of accounts, behaving kind of normally for awhile before they start doing... whatever it is they start doing (wow, having a short sleep is doing wonders for the memory).

]]>https://forum.fedi.dk/post/https://humanwords.party/ap/users/116332936916637974/statuses/116449185195841717https://forum.fedi.dk/post/https://humanwords.party/ap/users/116332936916637974/statuses/116449185195841717Wed, 22 Apr 2026 15:59:13 GMT<![CDATA[Reply to I've noticed a very slow trickle of fake accounts registering at my instance recently. on Wed, 22 Apr 2026 15:44:42 GMT]]>@sb

Whatever it is, I wouldn't count on it being anything good! Something smells like billionaire to me...

]]>https://forum.fedi.dk/post/https://kolektiva.social/users/Quasit/statuses/116449128102914226https://forum.fedi.dk/post/https://kolektiva.social/users/Quasit/statuses/116449128102914226Wed, 22 Apr 2026 15:44:42 GMT<![CDATA[Reply to I've noticed a very slow trickle of fake accounts registering at my instance recently. on Wed, 22 Apr 2026 15:44:21 GMT]]>@sb A lot of times, nefarious accounts just sit idle for a long time before being called into action.

It's also worthy to note, with Mastodon, users can setup interactions to be filtered under a special area in notifications for news accounts, as well as other settings... So, if a new account tries to send spam within the first 30 days, it will get filtered behind a special area in notifications. They could be for future nefarious use,

]]>https://forum.fedi.dk/post/https://oldfriends.live/users/paul/statuses/116449126766413090https://forum.fedi.dk/post/https://oldfriends.live/users/paul/statuses/116449126766413090Wed, 22 Apr 2026 15:44:21 GMT<![CDATA[Reply to I've noticed a very slow trickle of fake accounts registering at my instance recently. on Wed, 22 Apr 2026 15:40:29 GMT]]>@sb
Any important elections coming up?

]]>https://forum.fedi.dk/post/https://mastodon.social/users/dbrand666/statuses/116449111509313173https://forum.fedi.dk/post/https://mastodon.social/users/dbrand666/statuses/116449111509313173Wed, 22 Apr 2026 15:40:29 GMT<![CDATA[Reply to I've noticed a very slow trickle of fake accounts registering at my instance recently. on Wed, 22 Apr 2026 15:35:01 GMT]]>@sb scary.....

]]>https://forum.fedi.dk/post/https://circumstances.run/users/hipsterelectron/statuses/116449090026472607https://forum.fedi.dk/post/https://circumstances.run/users/hipsterelectron/statuses/116449090026472607Wed, 22 Apr 2026 15:35:01 GMT