this post was submitted on 09 May 2025
132 points (98.5% liked)

Fediverse

33392 readers
106 users here now

A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).

If you wanted to get help with moderating your own community then head over to !moderators@lemmy.world!

Rules

Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)

founded 2 years ago
MODERATORS
 

I've been noticing an influx of users with anonomized usernames (ie: fjdasklfpudiosa722104891fdaf20j.srv.us).

As a moderator this concerns me because it immediately triggers a 'this is a bot or nefarious actor' instinct. Is there any reason not to be wary of these accounts?

top 34 comments
sorted by: hot top controversial new old
[–] swelter_spark@reddthat.com 2 points 4 hours ago

I always use randomly-generated user names. I try to avoid strings of random numbers and letters, but coming up with reasonably nice-looking random names is time-consuming, and some people might not care that much.

[–] capybara@lemm.ee 4 points 12 hours ago

If I wanted to create bot accounts I would generate believable names

[–] meh@lemmy.blahaj.zone 6 points 15 hours ago

some people don't like personalizations. this is the first account in at least 10 yrs i picked a username for. normally it's just the string a password generator spit out. this time, i guess i figured after surving 18 months on world before deleting the account and moving. i could put 5 seconds into picking a name, since i'll likely be on lemmy until it dies. at some point in the next year i may add the word 'no' to my bio but thats an excessive amount of personalization for me.

[–] RandomVideos@programming.dev 3 points 19 hours ago

There are people that have a name that looks random, but has a meaning

[–] DarkDarkHouse@lemmy.sdf.org 16 points 1 day ago

No more wary than, say, CriticalBadger or SuccessfulCrab45. Some of the more obvious bots have very normal-looking names.

[–] mEEGal@lemmy.world 44 points 1 day ago

sounds reasonable, because this definitely looks like low-effort bots

[–] death@infosec.pub 35 points 1 day ago* (last edited 1 day ago) (1 children)

I've been using Fedi for a long time and from the very beginning I've been afraid of spam and bots ruining it, at least temporarily. Spam is still a problem with e-mail, and it's been around for 40 years and they've developed very sophisticated anti-spam mitigations for it.

[–] Zero22xx@lemmy.blahaj.zone 14 points 1 day ago (3 children)

The problem is that most of the 'spam' comes from official things like websites that you've signed up to and didn't realise would also include dumb fkn emails periodically. And they don't always do it right away either. I've had emails suddenly start arriving from somewhere that I signed up to like a year before.

Personally, my spam mitigation is to have one email address for signing up to shit with. Then these assholes can email me until they're blue in the face and I don't care because the only time I ever visit that inbox is for verification. And then I have another email address for personal use that never gets used because who uses email for personal use these days?

In conclusion. Email is for signing up to things and collecting trash that I'll never look at.

[–] death@infosec.pub 13 points 1 day ago (2 children)

That's probably just mail that lands in your spam folder without being entirely blocked. According to Microsoft and Google approximately 99% of incoming spam (of the ~160 billion spam emails sent per day) never even reaches their users mailboxes. I assume that's roughly standard across email providers. I am concerned comparably sophisticated filtering may become necessary on the Fediverse eventually.

[–] swelter_spark@reddthat.com 1 points 3 hours ago

My Google and Microsoft accounts are the only ones I ever get random spam on, tbh. I've never had any amount of unasked for mail with a paid provider or ISP's email.

[–] SorteKanin 3 points 1 day ago

I get the concern but I don't think you need to be as concerned as with email. Email is a lot simpler without a lot of validation. On the fediverse, HTTP Signatures are used to verify requests, so you can't spoof stuff as easily.

That said, spam mitigation will probably still be an issue that continuously needs to be dealt with.

[–] Flax_vert@feddit.uk 5 points 1 day ago

I, for the life of me, couldn't stop nextdoor from emailing me. I could unsubscribe myself from one category of email and they'll start popping up again. Just had to block it on my end.

[–] schnurrito@discuss.tchncs.de 2 points 1 day ago (1 children)

IMHO messages from things you've signed up to are unlikely to be "spam". I've always understood that word to mainly mean completely unsolicited messages from people you have no previous relationship with at all; though if it's clearly unwanted it might include some of the former too.

[–] spankmonkey@lemmy.world 4 points 1 day ago* (last edited 1 day ago)

A ton of things I have signed up for spam me with trash emails that they don't put in the 'sales' or 'offers' categories I unchecked. Just because I was forced to create an account to buy one thing doesn't mean I have a 'business relatiotionship' that justifies multiple daily reminders of what they have in stock.

[–] user@startrek.website 13 points 1 day ago (1 children)

You're mostly right -- those names sound like overkill. However do note I have been using Bitwarden's Name Generator (random noun + number) and I've evolved the scheme a bit ( it is now always 'user' and I keep adding numbers until the generated username is available ).

[–] Redecco@lemmy.world 9 points 1 day ago (1 children)

john user himself

[–] Kualdir@feddit.nl 24 points 1 day ago (3 children)

Technically it can be someone who just wants to be anonymous, but honestly they could at least use something readable

[–] AnonomousWolf@lemmy.world 14 points 1 day ago (3 children)

Using a barcode username is nice for being anonymous

Eg.

IlIIIllIIl

It's a combination of lower case L and upper case I

[–] nokturne213@sopuli.xyz 2 points 16 hours ago
[–] Kualdir@feddit.nl 8 points 1 day ago

Flashbacks to Rainbow Six Siege cheaters 💀

[–] dr_robotBones@reddthat.com 4 points 1 day ago

That's incredible, I'll use this in the future

[–] joyjoy@lemm.ee 6 points 1 day ago (1 children)

If they want to be anonymous, sure. But they should at minimum change their display name to "Anonymous"

[–] Kualdir@feddit.nl 1 points 1 day ago

Totally agreed

[–] Hamartiogonic@sopuli.xyz 3 points 1 day ago (1 children)

Also, some people will intentionally add numbers at the end of the alias to make it look like all the good names were already taken. Sort of like a joke or a reference to all the bigger social media platforms.

[–] Kualdir@feddit.nl 3 points 1 day ago (1 children)

I don't really understand that one haha

[–] swelter_spark@reddthat.com 1 points 4 hours ago

It used to be common.

[–] e0qdk@reddthat.com 13 points 1 day ago

I picked an RNG name since my old common username (from reddit, etc) was not available when I started on kbin.social (RIP) and I couldn't think of anything else I wanted to be called. I deliberately kept it short though. Not sure what to make of other RNG names -- esp. long unintelligible ones -- but I've seen at least one account that I think is legit which has a long, bizarre RNG-looking username and a non-English display name, so 🤷️

[–] fxomt@lemmy.dbzer0.com 20 points 1 day ago* (last edited 1 day ago) (1 children)

Checking the modlog i see one user - @abff08f4813c@j4vcdedmiokf56h3ho4t62mlku.srv.us, who [despite the weird name] seems like a legitimate account.

Which the reason afaik they have such a weird name is: https://lemmy.dbzer0.com/post/26773150/14235814

Are there any other users you've noticed with this type of username/instance name? This is the only one i saw.

[–] Burstar@sopuli.xyz 3 points 1 day ago (1 children)

Which the reason afaik they have such a weird name is:

Wierdly, when I click on the link I get a 'server cannot handle the request error'.

Regardless, I agree that it 'acts' like a legit account, but still think it's sus as hell. That entry in the modlog is from today, but I've definitely handled similar accounts in the past, and seen others do so elsewhere.

[–] fxomt@lemmy.dbzer0.com 10 points 1 day ago (1 children)

Sorry bout that. Instance was down for some time.

Anyways here's a mirror just in case

That entry in the modlog is from today, but I’ve definitely handled similar accounts in the past, and seen others do so elsewhere.

I didn't see any of that, but i'll take your word for it. Still, this is most likely, if not definitely a real account.

[–] Burstar@sopuli.xyz 3 points 1 day ago

Ah, thanks for this.

[–] hisao@ani.social 9 points 1 day ago

My first guess with this would be: they were read-only, then they wanted to post something or write a reply to someone and at the time considered it to be a one-time thing and created sort of "throwaway account" for that specifically, but then they kept visiting the place and it kind of just stick with them. Yet again, my guess might be completely wrong. But at least this is one of the possible motivations behind such accounts.

[–] crawancon@lemm.ee 3 points 1 day ago

maybe we could create a suspicious account review channel and submit them there for folks to do some digg'ing.

not sure about comms with other Admins but it would be nice to harmonize efforts amongst them a bit more/better.