This page will collate posts that share advice and guidance on the spam registration activity connected to “BoomProtocolProbe” and the bulk creation of #bpSpam accounts.

Notes: Over the course of days, the attack has changed approach several times. Each mitigation is quickly overcome. Please do not overly-share specific details as the actor in question may be monitoring the network for mitigations and adapting accordingly. Use your private groups, backchannels, email etc to communicate with your trusted peers. If you wish to share with the community, please use #bpSpam to help others find your content.

An extensive analysis of the activity and it’s related online spam-as-a-service business is available.

Mastodon and forks allow banning the use of certain usernames at /admin/username_blocks – this will stop emails going out as the username cannot be chosen, but it will stop any and all usernames (including valid requests) containing “bp” or “usr_” – this should be considered a temporary measure.

Helpful Posts

Admin Jerry

[email protected]

@iftas
I set up a rule in Mastodon to require approval for any name with "bp" and after rejecting dozens manually, I finally set up a Cloudflare edge rule. So far it has blocked 59 attempts to open accounts here after running for about 8 hours today (10-Sep)

What is wrong with this person?

The rule I set, which I hope is only temporary, is to block if this is true:

(http.user_agent contains "aiohttp" and http.request.uri.path contains "/oauth")

2026-09-11, 02:32 1 boosts 1 favorites

The Overgoddess

[email protected]

If u are seeing a wave of spammy regs today and u want a quick fix, we have one that is working. We are not sharing publicly to avoid the spammer seeing and changing the junk, but is okie to msg if u need help.

Takes like… 2 minutes.

#fediblock #FediAdmin #fediMod

2026-09-10, 20:58 6 boosts 6 favorites

https://mastodon.pnpde.social/@spielleitung/117242341921660658 offers a database trigger for Mastodon and PeerTube: https://pad.pnpde.social/p/FUloCtoOiNZPX6d18-_r

Fediponics beta testers can use Custom Keyword Groups to auto-suspend these accounts

Michael

[email protected]

New solution for #BoomProbe with lua-nginx-module

#mastoadmin #spam #gotcha #BoomProtocol

2026-09-11, 17:22 2 boosts 5 favorites

Flippin' 'eck, Tucker!

[email protected]

@stux @iftas Seems reasonable. Glitch-Social has recently merged this PR which does exactly that: https://github.com/glitch-soc/mastodon/pull/3659

2026-09-12, 16:18 2 boosts 2 favorites

🏳️‍⚧️ Christin Löhner 🏳️‍🌈

[email protected]

Dear #Fediverse and #Mastodon admins

currently there is a massive wave of spam registrations everywhere in the fediverse.

For mastodon, I have a solution that works for me:

Create new file /etc/nginx/conf.d/lsbt-registration-spam.conf:

 map "$request_method:$uri:$http_user_agent" $block_lsbt_registration_spam {
 default 0;
 ~^POST:/api/v1/accounts:Python/3.[0-9]+ aiohttp/ 1;
 }

Add to the server block in /etc/nginx/sites-available/mastodon:

 location = /api/v1/accounts {
 if ($block_lsbt_registration_spam) {
 return 403;
 }

 try_files $uri @proxy;
 }

@michaela @njakob @MikeGorden
#fediverse #mastodon #registrationspam #spam #registration #Automatedprotocoldeliverabilityprobe #lsbt

2026-09-11, 05:24 34 boosts 26 favorites

admin

@[email protected]

Come abbiamo fatto a ridurre drasticamente le richieste di registrazione degli spambot AI: una guida per amministratori di istanze Mastodon

https://gatti.ninja/posts/mitigazione-account-spam-su-mastodon/

#Mastodon #fediverso #registrazioni #spam

2026-09-17, 15:34 5 boosts 4 favorites

https://javahippie.net/mastodon/security/2026/09/11/mastodon-signup-spam.html demonstrates a database constraint

https://gist.github.com/chofstede/a422427570004719196cde948521dd04 ruby username validator

CrowdSec rules https://git.rollenspiel.monster/ansible-playbooks/proxymanager/src/branch/main/templates/crowdsec/appsec-rules

If you see a resource or advice worth sharing on this page, please message @iftas using the hashtag #bpSpam