PS : And Piefed already achieve most of these.

:::spoiler How it works ?

1) New accounts are scanned automatically

The scanner runs on a configurable interval or in real time via Mastodon webhooks, checking new signups as they arrive.

2) A risk score is assigned based on 70+ signals

Username patterns, email analysis, profile completeness, signup timing, IP reputation, and more are each weighted and summed into a 0–100 score.

3) Actions are applied based on configurable thresholds

Accounts that cross your thresholds are automatically silenced, frozen, or suspended — no manual review needed for obvious bots.
:::

:::spoiler What gets checked ?

Each signal adds points to the account's risk score. You can enable or disable any signal.

Username

• Suspicious character patterns
• Excessive numeric suffixes
• Known bot naming conventions

️ Email

• Disposable email providers
• Suspicious TLD patterns
• Commercial & payment domains

🪪 Profile

• Missing avatar or header
• Empty bio
• No posts after signup

Timing

• Late-night signups (1am–6am)
• Configurable timezone

IPQualityScore (optional API key)

Email fraud score

• Honeypot / spam trap
• Disposable email (IPQS)
• Recent email abuse

IP fraud score

• VPN / proxy detection
• Bot activity flag
• Recent IP abuse

:::

:::spoiler Scoring system : customizable rules

Every aspect of the scoring system can be tuned to fit your community's needs.
️

Action thresholds

Set independent score cutoffs for silence/limit, freeze, and suspend. Accounts scoring below all thresholds are left alone.
️

Per-signal weights and toggles

Enable or disable any individual check. Adjust score weights so signals that matter more to your instance have greater impact.

Custom domain & keyword lists

Maintain your own lists of suspicious TLDs, commercial domain keywords, and payment processor domains used in email addresses.

Dry-run mode

Preview exactly which accounts would be actioned and why, without making any changes. Tune your rules until you're confident, then go live.
️

Flexible trigger modes

Run on a scheduled interval to catch up on recent signups, or use Mastodon's account.created webhook for real-time scanning the moment an account is created.

:::

FediForum | Fediponics: Automated Bot Detection and Moderation for Mastodon Instance Administrators

Notes from an unconference session at FediForum October 2026. Topics: Trust & safety, Hosting & operations.

FediForum (fediforum.org)