We suspect that the fediverse is being leveraged for a C&C style DDoS attack against arbitrary domains.
Suspected malicious domains
*.activitypub-troll.cf
*.misskey-forkbomb.cf
*.repl.co
Resource on blocking server domains
Bota
getchannels
Core
vinylteque
To: https://2jb3chx5h.activitypub-troll.cf/inbox
{
"@context":"https://www.w3.org/ns/activitystreams",
"id":"https://hachyderm.io/users/vinylteque#delete",
"type":"Delete",
"actor":"https://hachyderm.io/users/vinylteque",
"to":["https://www.w3.org/ns/activitystreams#Public"],
"object":"https://hachyderm.io/users/vinylteque",
"signature":{
"type":"RsaSignature2017",
"creator":"https://hachyderm.io/users/vinylteque#main-key",
"created":"2022-12-03T18:28:09Z",
"signatureValue":"redacted"
}
}
109406507175403490
The URL above is random.
A user report came in from @Ghryphen at approximately 2:45 AM, indicating possible spam. I don't know where the user spotted the spam, it may make sense to reach out and ask.
Tani's guess is the message was seen in the federation stream.
activitypub-troll.cf
and all subdomains are defederated by hachyderm.
It appears that the pull queue still attempts to work through the pull queue.
When the bots are deleted, they cause a significant quantity of traffic.
The load isn't high on our servers, and the failure timeout increases exponentially.
We would likely have to write some code to do this, also risky since it is a destructive action.
Easy to implement, need to validate ruby is respecting the settings.
Since we split the queues from the web server, we might be able to just redirect all traffic to these addresses to 127.0.0.1
Attacker hosted the source of the attack.
Reach out if you want to review
or
or
By clicking below, you agree to our terms of service.
New to HackMD? Sign up
Syntax | Example | Reference | |
---|---|---|---|
# Header | Header | 基本排版 | |
- Unordered List |
|
||
1. Ordered List |
|
||
- [ ] Todo List |
|
||
> Blockquote | Blockquote |
||
**Bold font** | Bold font | ||
*Italics font* | Italics font | ||
~~Strikethrough~~ | |||
19^th^ | 19th | ||
H~2~O | H2O | ||
++Inserted text++ | Inserted text | ||
==Marked text== | Marked text | ||
[link text](https:// "title") | Link | ||
 | Image | ||
`Code` | Code |
在筆記中貼入程式碼 | |
```javascript var i = 0; ``` |
|
||
:smile: | ![]() |
Emoji list | |
{%youtube youtube_id %} | Externals | ||
$L^aT_eX$ | LaTeX | ||
:::info This is a alert area. ::: |
This is a alert area. |
On a scale of 0-10, how likely is it that you would recommend HackMD to your friends, family or business associates?
Please give us some advice and help us improve HackMD.
Syncing