XMPP Service Operators - 2024-05-18

my server is currently under spam attack by rewtkid alts on various public registration servers.

Yax.im, xmpp.earth, and jabbim.im are temporarily blocked from some mucs

> my server is currently under spam attack by rewtkid alts on various public registration servers. rewtkid is a spammer? ↺

Yes.

doesn't he host his own server? ✏

But that has nothing to do with anything, does it?

well shouldn't it be ban listed then?

The spam comes from other servers

how do you know its rewtkid

Possible: rewtkid@srvA.com rewtkid@srvB.com rewtkid@srvC.com ?

oh right... that would explain it...

what about inpersonations though?

Keep in mind that means nothing

ok whats rewtkids server?

all I remember is its the anarchism one

But this doesn't make it true that he is really doing it. Everybody could be rewtkid@....

that is why I am asking for his server :)

Does anyone remember his JID?

not the "alts"

Has anybody ever seen his JID ? Here it will only be shown as operators@muc.xmpp.org/rewtkid

I know well it is the same rewtkid. Rewtkid admitted to DDoSing a server he disagreed with ages ago and at the same time these spam attacks have occured, the same DDoS method is being used against my service. Rewtkid has a vendetta against me because of someone I associate myself with. ✏

The ban "must" be: rewtkid@* except rewtkid@trueserver Don't think that this will be possible by banlist. BUT.... This seems to by a personal fight between nuegia (and/or worlio) and rewtkid ? Why should the global banlist be used to eleminate a personal war ?

Why would you want someone on your service who seems to attack and DDoS services for their own personal grudges?

The serveradmin of the muc should ban him locally, but not the whole univers.

You could try and ban all the JIDs you want. He is constantly making alternate accounts to spam MUCs from people he doesn't like.

> Why would you want someone on your service who seems to attack and DDoS services for their own personal grudges? Maybe you told him a "freak" or "motherf.." or your political view is not his or you are driving the wrong car/bike/.... ? What are his grudges ? Maybe you will let block me global because I'm driving a truck and you a bicycle-rider and we are all potential bicycle-killers.

I don't ban for differing views. His attacks are nothing but grudges against who I sided with when he was banned from a no-longer existing MUC.

Considering the doxbin stuff going on surrounding Rewtkid and the people he knows... I don't think I want to poke this with a 6 foot pole even

Regardless of how he feels about it, it does not excuse the behavior. He is spamming and DDoSing services.

That's true. Unfortunately someone manually creating accounts is basically impossible to pre-ban anyway.

The goal was to let others know of their current abuse and the services he is using.

rewtkid leaked his server replying to me a few months back

unfortunately searching the archives seems impossible...

And as such, here are JIDs which he used to spam a MUC of my own: 4trt456534rtg@dismail.de cronjober345etrre@5222.de fsdger654fdg@dismail.de rewtkid@jabbim.com spamdontyanknowitsmybestfriend@yax.im waaaaa543645@draugr.de

I know that server and the conversations. I have the archive here.. That isn't a secret

Menel, whats his server then?

his not one of the many which worlio.com is reporting

the one we can confirm is rewtkid

No, he wouldn't be using his main.

plus I think it might be useful to write a script to check the archives... they are useless currently, unless you know the exact day you are looking for

> No, he wouldn't be using his main. unhelpful. ↺

worlio.com: How will you ban him if he is always using different nicks and servers ?

You folks are missing the point.

what point, the fact that a bunch of people have a flame war with rewtkid right now?

More like rewtkid is having a war with a bunch of people.

can you verify these alts are his?

They happened all within 5 seconds of each other after the MUC invite was posted in Spyware when Spyware was being hit with the spam attacks from him. Those spam attacks from Spyware were using names that had been lurking for a long time, which is a tactic rewtkid is known to do.

Polarian: seems it was taken down meanwhile. https://b1t.rip/

And his original jid server is no longer around either.

Menel, this seems more like rewt is the target, not rewt targetting others

My point is to let people know a malicious user is on the loose and to be aware their services may be used negatively if they are open.

» [13:42:45] <Polarian> Menel, this seems more like rewt is the target, not rewt targetting others Why would I target this person?

also the account listed on the site is gone too

> » [13:42:45] <Polarian> Menel, this seems more like rewt is the target, not rewt targetting others > Why would I target this person? not you specifically... ↺

> My point is to let people know a malicious user is on the loose and to be aware their services may be used negatively if they are open. I could go around pretending to be you, does that mean you should be punished for it? ↺

assume good faith, even if you hate the guy.

Let's focus for a moment now. 1: Someone is spamming rooms and creating manually random accounts everywhere. So. What is there that anyone can do? I don't think much beside beeing vigilant and using moderation tools.

Menel: » [13:42:46] <worlio.com> My point is to let people know a malicious user is on the loose and to be aware their services may be used negatively if they are open.

The rest of the reasons or whatever doesn't help here.

Please read.

OK we know now ✏

> Let's focus for a moment now. > 1: Someone is spamming rooms and creating manually random accounts everywhere. > > So. What is there that anyone can do? I don't think much beside beeing vigilant and using moderation tools. main servers cut registration for a while maybe? ↺

or limit it right down

Because of one user you want the whole network to shut down? Talking about DOS

no... but like when a MUC is raided, limit it more

I have received stuff last night... not sure if its related...

> Menel: > » [13:42:46] <worlio.com> My point is to let people know a malicious user is on the loose and to be aware their services may be used negatively if they are open. theres nothing you can do about this... ↺

What I can do about it: Alert service operators.

What I did about it: Alert service operators.

Yes. I know. Everyone knows now, I think we're on the same page.

Then no more confusion?

does anyone know a legitimate way to get to rewtkid... without trusting an alt is him

I think we don't need to speak of it further here.

Polarian: didn't you read the website, there was an address

> Polarian: didn't you read the website, there was an address it doesn't work ↺

» [13:49:52] <Polarian> does anyone know a legitimate way to get to rewtkid... without trusting an alt is him Every single primary account he has used is down or inaccessible.

who owns thesecure.biz?

OK. If they want to speak with you, I think they would. Likely reading along in this room...

> » [13:49:52] <Polarian> does anyone know a legitimate way to get to rewtkid... without trusting an alt is him > Every single primary account he has used is down or inaccessible. and you still think its him targetting others? ↺

Well I have both the primary JIDs he has used so I have the necessary information to respond.

sounds like like a attack on him, and everyone else is collateral damage

From his b1t.rip/syn.rip accounts, he has messaged an associate of mine admitting to performing DDoS attacks.

In the now down chat of b1t.rip, he has talked about abusing other services that involve me, a member named jsj, and anything he uses because he has a deep hatred of jsj for banning him from the now gone MUC.

Sound like jumping to conclusions. But this isn't a courtroom anyway. Could we focus on operators and not vendetta and wars here? The relevance for operators is: Someone is spamming rooms.

For someone to impersonate rewtkid to this level that fits exactly his MO as when he was originally identified as a malicious actor, that'd be quite impressive but very stupid of them.

Especially since some of his actions have not always been publicly discussed.

» [13:53:51] <Menel> Sound like jumping to conclusions. It is not jumping to conclusions if they have admitted to it.

> ‎05/18/24 | 12:59:53 ‎Polarian‎: doesn't he host his own server? > ‎05/18/24 | 13:04:31 ‎Polarian‎: well shouldn't it be ban listed then? yes, i've already had to ban and firewall those off

that's why he's using public reg servers now

I don't know what's going on or why with rewtkid, but I did have to ban them. If other server operators don't want to clean out a bunch of throwaway spammer jids from their servers and their servers are used in attacks against my network I have no choice but to not restore federation between them which is something i do not want to do

I don't know what's going on between rewtkid and other servers, but I think it's pretty weird there's this long wall of text overnight accusing other server ops of things.

it's not helpful when there is a spam attack going on

> If other server operators don't want to clean out a bunch of throwaway spammer jids from their servers and their servers are used in attacks actually, if your a server operator and aren't willing to do this, don't run a public registration server with federation to other servers.

I'm not sure if I missed something, but all the posted jids are already banned, aren't they.? And reported to the server admins too. I don't think anyone wants spam.

I'm sure you're not receiving spam from these jids then. It is the next unknown jids that will be used next time that your defederstion prevents. And other server operators can't ban unknown manually created accounts

Sadly there is no rule how to recordnize a newly created spam-account, therefor it is not possible to make a module for e.g prosody or ejabberd. 🤷🏼‍♂️

An ejabbered module like https://modules.prosody.im/mod_report_forward.html would be nice tho

It will only forward spam-reports from reports of users which have been spamed. Same as here is doing via msg. The AI is the user, not the system. This will only growup the blocklist, to just make long story short, let us block [a-z0-9]{1,255}@[a-z0-9]{1,255} 😉

I just block 0.0.0.0/0

sarcasm?

*@*