Post · bonfire.cafe

⚠️ SW-ISAC Advisory

A Russian propaganda spam network comprising hundreds of accounts remains active on numerous ActivityPub services.

We are directly contacting affected services, but all admins should check for new accounts spamming Telegram channel links.

Common usernames:
indiereports
alt-mirror
iskand3r
ukrdef
kaconi
indienews
altnews
winixa

Full list at https://connect.iftas.org/library/iftas-documentation/spam-fediverse-services/

Based in part on BlueSky accounts identified and shared to us by Antibot4Navalny

IFTAS

@iftas@mastodon.iftas.org replied · 2 days ago

As a timely reminder, our DNI list includes 77 domains we strongly recommend for defederation.

Some are known to be expired, but they remain on the list for safety's sake.

Each domain is labelled and was investigated by human review. This is not an automated or consensus list.

A Mastodon format CSV for import is available at https://connect.iftas.org/library/iftas-documentation/iftas-dni-list/

Inclusion on the DNI list means we are extremely confident the domain will never be retracted from the list.

#FediAdmin #MastoAdmin

IFTAS

@iftas@mastodon.iftas.org replied · 3 days ago

Update:

Spam accounts continue to be created and volunteers are flagging them as we find them.

Roughly 80% of observed accounts have been taken down, and the observed usernames list is being updated daily (see above for link).

If you see a report for an account you believe to be a false positive, please let us know.

Dave Clark

@bedirthan@dice.camp replied · 5 days ago

@iftas on the full list are BBC and France24. Are these both impersonators of the authentic orgs?

IFTAS

@iftas@mastodon.iftas.org replied · 5 days ago

@bedirthan if the additional indicators listed on that page are also there (recently registered, throwaway domain used for registration, links to Telegram channels) they may be.

The username is a starting point for investigation, but should not be considered in and of itself proof of inauthentic account status.

IFTAS

@iftas@mastodon.iftas.org replied · 5 days ago

@bedirthan We observed three associated accounts on three different Mastodon services with a BBC username, and one associated account with a France24 username.

They have all been suspended.

Dave Clark

@bedirthan@dice.camp replied · 5 days ago

@iftas thank you for the clarifications.

Way back, ending in 2016, I was a moderator at Newsvine. One of the last things we learned before being shutdown was that we were a target of the Fancy Bear project

IFTAS

@iftas@mastodon.iftas.org replied · 5 days ago

related references:

https://bsky.app/profile/antibot4navalny.bsky.social/post/3m22256476k25

https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/

https://www.sgdsn.gouv.fr/files/files/20240212_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_ENG_VF.pdf

https://checkfirst.network/pravda-network-worldwide-expansion-and-llm-wikipedia-pollution/

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About · Code of conduct · Privacy · Users · Instances

Bonfire social · 1.0.0-rc.3.13 no JS en

Automatic federation enabled