Discussion
⚠️ SW-ISAC Advisory
A Russian network creating hundreds of accounts on >150 servers remains active, constituting coordinated inauthentic behaviour, and spam.
We are directly contacting affected services, but all admins should check for new accounts that match the indicators.
Common usernames and other indicators of compromise are at
https://about.iftas.org/library/known-spam-fediverse-services/
Based in part on BlueSky accounts identified and shared to us by Antibot4Navalny
@iftas its be really useful if this could be done to tracc all the IDF accounts that sprang up to do hasbarah
As a timely reminder, our DNI list includes 78 domains we strongly recommend for defederation.
Some are known to be expired, but they remain on the list for safety's sake.
Each domain is labelled and was investigated by human review. This is not an automated or consensus list.
A Mastodon format CSV for import is available at https://about.iftas.org/trust-safety-services/iftas-do-not-interact-dni-list/
Inclusion on the DNI list means we are extremely confident the domain will never be retracted from the list.
Update 2025-10-28
Accounts identified: 648
Accounts mitigated: 479
Servers affected: 168
Servers with active accounts: 38
Spam accounts continue to be created and SW-ISAC volunteers are flagging them as we find them.
Many observed accounts have been taken down, and the observed usernames list is being updated daily (see above for link).
If you receive a report from this account you believe to be a false positive, please let us know.
@iftas on the full list are BBC and France24. Are these both impersonators of the authentic orgs?
@bedirthan if the additional indicators listed on that page are also there (recently registered, throwaway domain used for registration, links to Telegram channels) they may be.
The username is a starting point for investigation, but should not be considered in and of itself proof of inauthentic account status.
@bedirthan We observed three associated accounts on three different Mastodon services with a BBC username, and one associated account with a France24 username.
They have all been suspended.
@iftas thank you for the clarifications.
Way back, ending in 2016, I was a moderator at Newsvine. One of the last things we learned before being shutdown was that we were a target of the Fancy Bear project
A space for Bonfire maintainers and contributors to communicate
