⚠️ SW-ISAC Advisory
A Russian network creating hundreds of accounts on >150 servers remains active, constituting coordinated inauthentic behaviour, and spam.
We are directly contacting affected services, but all admins should check for new accounts that match the indicators.
Common usernames and other indicators of compromise are at
https://about.iftas.org/library/known-spam-fediverse-services/
Based in part on BlueSky accounts identified and shared to us by Antibot4Navalny
@iftas its be really useful if this could be done to tracc all the IDF accounts that sprang up to do hasbarah
As a timely reminder, our denylists includes these domains, which we strongly recommend for action.
Some are known to be offline, but they remain on the list for safety's sake.
Each domain is labelled and was investigated by human review. These are not automated or consensus lists.
AUD List: https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/
Update 2025-11-03
Accounts identified: 754
Accounts mitigated: 548
Servers affected: 182
Servers with active accounts: 49
Spam accounts continue to be created and SW-ISAC volunteers are flagging them as we find them.
Many observed accounts have been taken down, and the observed usernames list is being updated daily (see above for link).
If you receive a report from this account you believe to be a false positive, please let us know.
@iftas on the full list are BBC and France24. Are these both impersonators of the authentic orgs?
@bedirthan if the additional indicators listed on that page are also there (recently registered, throwaway domain used for registration, links to Telegram channels) they may be.
The username is a starting point for investigation, but should not be considered in and of itself proof of inauthentic account status.
@bedirthan We observed three associated accounts on three different Mastodon services with a BBC username, and one associated account with a France24 username.
They have all been suspended.
@iftas thank you for the clarifications.
Way back, ending in 2016, I was a moderator at Newsvine. One of the last things we learned before being shutdown was that we were a target of the Fancy Bear project
