dansup,
@dansup@mastodon.social avatar

Spammers have registered hundreds of random 5 digit accounts on pixelfed.social by using the in-app registration APIs.

None of the accounts were able to verify email address or become active thanks to the magic app links.

I recommend disabling this with PF_ALLOW_APP_REGISTRATION=false until we put in place more rate limits to these endpoints.

tercean,

@dansup i think i have some 10k new acc on .de. that's gonna be fun to clean up :D

dansup,
@dansup@mastodon.social avatar

@tercean Find the app_register_ip then run this

$users = User::whereAppRegisterIp('XXX')->get();

foreach($users as $user) {  
 \App\Jobs\DeletePipeline\DeleteAccountPipeline::dispatch($user);  
}  
tercean,

@dansup they're from different IPs, in batches of a couple thousand accounts per IP. probably not easy to select based on a netblock, right?

dansup,
@dansup@mastodon.social avatar

@tercean Ah I see, will work on adding support to bulk select/manage users in the dashboard based on ip range

tercean,

@dansup the delete pipeline didn't seem to do anything, but i wrote out a file with user ids and deleting them from a bash loop now. seems to work :)
although i'd really like to get rid of th deleted accouts completly at some point - don't have to have 40k users when almost half of them never existed

tercean,

@dansup chucked them out with user->delete() via tinker, my account list is clean again :D

dansup,
@dansup@mastodon.social avatar

@tercean Just shipped an update that blocks cloud ip ranges from login/registration and api routes!

https://github.com/pixelfed/pixelfed/pull/4312

This should prevent this from happening again.

tercean,

@dansup nice, deployed 👍 :)

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • DreamBathrooms
  • ngwrru68w68
  • modclub
  • magazineikmin
  • thenastyranch
  • rosin
  • khanakhh
  • InstantRegret
  • Youngstown
  • slotface
  • Durango
  • kavyap
  • mdbf
  • GTA5RPClips
  • JUstTest
  • tacticalgear
  • normalnudes
  • tester
  • osvaldo12
  • everett
  • cubers
  • ethstaker
  • anitta
  • provamag3
  • Leos
  • cisconetworking
  • megavids
  • lostlight
  • All magazines