8 Commits

Include renames

Author	SHA1	Message	Date
pmb	a7208a84d1	Cache ipapi.is results by CIDR range instead of exact IP ... Uses asn.route from ipapi.is to bucket the classification cache by network block (IPv4 and IPv6), so signups from the same datacenter/ASN block no longer each burn a separate lookup against the 1000/day quota. Falls back to a single-address range when route is missing or doesn't actually contain the queried IP.	2026-07-13 08:35:55 -07:00
pmb	319f0bd0f9	fixin a spelling error	2026-07-07 15:52:24 -07:00
pmb	25bc4a1a70	Fix suspicious-watch baseline snapshot to use the admin accounts API ... fetch_account_counts() was hitting the public /api/v1/accounts/:id endpoint, which 404s for any account that hasn't confirmed its email yet. Most flagged signups haven't confirmed at the moment account.created/approved fires, so the baseline snapshot silently failed and the account never entered suspicious_watch -- 6 of 8 IP-flagged signups to date missed the sweep entirely. Switch to the admin endpoint suspicious_sweep.py already uses successfully.	2026-07-06 18:16:55 -07:00
pmb	51233868ca	Act immediately on flagged signups Mastodon already auto-approved ... account.approved never fires for a signup that went through open registration without ever being queued (no prior block on that address). process_signup was waiting on that event forever, so the first flagged signup on any new bad IP/email domain never got welcomed or watched by the suspicious-sweep. Now checks Admin::Account.approved from the account.created payload and acts immediately if it's already true.	2026-07-06 13:27:15 -07:00
pmb	0356fe7997	Replace RDAP/ipwhois signup-IP classifier with ipapi.is ... Flags datacenter, vpn, proxy, tor, and independently-scored abuser signals instead of regex-matching RDAP org names; anonymous tier covers 1000 req/day, well above signup volume.	2026-07-06 08:57:55 -07:00
pmb	9924e06b5a	Add suspicious-signup sweep: suspend flagged signups with no activity ... Watches every account flagged by IP-scrutiny or email-domain scrutiny at signup and, once it goes live, records a baseline post/follow count. A scheduled sweep (app/suspicious_sweep.py, run via cron on admin.yttrx.com) suspends any watch past SUSPICIOUS_GRACE_HOURS with zero new posts and zero new follows since that baseline; any activity clears the watch. Works whether yttrx is open-registration or requires moderator approval, since the watch starts at whichever event actually makes the account live (account.created vs account.approved), same dual handling the welcome flow already uses. Needs ABUSE_BOT_TOKEN re-minted with admin:read:accounts.	2026-07-05 10:22:39 -07:00
waffle2k	656eec09c0	Add disposable/high-risk email signup scrutiny via check-mail.org ... Classifies each signup's email domain (domain-only, GDPR-friendly) alongside the existing IP scrutiny signal, with matching held-welcome and auto email_domain_block behavior. A report against an account with a flagged domain suspends immediately (no reporter-count threshold) and blocks the domain, classified live from the report payload rather than any signup-time record so it also covers pre-existing accounts. Ships CHECK_MAIL_DRY_RUN=true by default, independent of ABUSE_DRY_RUN, so the new report-triggered suspend path stays inert until watched.	2026-07-03 09:08:30 -07:00
pmb	c0e5df3cc4	Initial commit: welcome-bot, abuse-bot, dormant-sweep, IP signup scrutiny	2026-07-02 16:22:30 -07:00