The spam campaign attacking Writefreely instances is out of control. Can you contact the admins you know?
nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqg8nzq79lxtdky004lkkzxdsny8ec49z5mzqv0jzwa679ted8nzwq340nql (nprofile…0nql)
Yesterday I received this message from my friend nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7yr2jr0mtzvamucdw93u7s5lk6jznq84vh67dqsd0znjce9223wsyzyzvs (nprofile…yzvs):
Are you the one running the "writefreely blogs" bot, aka writefreely@poliverso.org? Because there are tons of English accounts full of links that post nonstop.
And indeed, that account republishing posts from some Italian instances had a staggering amount of spam.
This is due to a very serious vulnerability that hasn't yet been patched by the developers, but which has (obviously) started to be exploited on a large scale.
I've notified all the Italian administrators of nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7aejn8hcs5smqkpwemcdz6gdvsqfr4lqz3y3ycz8pvwl28aqklvq0hn7l8 (nprofile…n7l8) instances, but I'm having some difficulty contacting the foreign ones.
These are the ones with the most users:
https://write.otter.homes/read
https://infosec.press/read
https://blog.liberta.vip/read
https://write.tedomum.net/read
https://val-vgms.gay/read
https://bolha.blog/read
But there are many others.Is there anyone among you who can try this or at least spread the word?Note: As I mentioned, the vulnerability has been known for a long time and is currently being exploited on a large scale.
https://github.com/writefreely/writefreely/issues/1649
macfranc
npub1q7…ytwxf
2026-07-17 08:45:43 UTC
Author Public Key
npub1q7x5kvtn88dutjsjclua40mnc2xj3uauj3uhuaaklfgudvrxfx9s7ytwxfSeen on
wss://relay.ditto.pubPublished at
2026-07-17 08:45:43 UTCEvent JSON
{
"id": "346b362ff297121d98fef563beefbb198e2274a2a5a32aa8597fe1457b42ba0e",
"pubkey": "078d4b317339dbc5ca12c7f9dabf73c28d28f3bc94797e77b6fa51c6b066498b",
"created_at": 1784277943,
"kind": 1,
"tags": [
[
"p",
"41e62078bf32db623df5fdac23361321f38a9454d880c7c84eeebc55e5a7989c",
"wss://relay.ditto.pub"
],
[
"p",
"f106a90dfb5899ddf30d7163cf429fb6a42980f565f5e6820d78a72c64aa545d",
"wss://relay.ditto.pub"
],
[
"p",
"f773299ef88521b0582ecef0d1690d640091d7e014491260470b1df51fa0b7d8",
"wss://relay.ditto.pub"
],
[
"p",
"50ede5512123248293bf1757c364d0630ca84af723952139fb8d6bf06423ffb1",
"wss://relay.ditto.pub"
],
[
"p",
"69b9192b9fe5bd65498ede255b87200733423b48bc8e2d3d64174a30cbdd6bb0",
"wss://relay.ditto.pub"
],
[
"proxy",
"https://poliversity.it/users/macfranc/statuses/116934439283108578",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "The spam campaign attacking Writefreely instances is out of control. Can you contact the admins you know?\n\nnostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqg8nzq79lxtdky004lkkzxdsny8ec49z5mzqv0jzwa679ted8nzwq340nql\n\nYesterday I received this message from my friend nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7yr2jr0mtzvamucdw93u7s5lk6jznq84vh67dqsd0znjce9223wsyzyzvs:\n\nAre you the one running the \"writefreely blogs\" bot, aka writefreely@poliverso.org? Because there are tons of English accounts full of links that post nonstop.\n\nAnd indeed, that account republishing posts from some Italian instances had a staggering amount of spam.\n\nThis is due to a very serious vulnerability that hasn't yet been patched by the developers, but which has (obviously) started to be exploited on a large scale.\n\nI've notified all the Italian administrators of nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7aejn8hcs5smqkpwemcdz6gdvsqfr4lqz3y3ycz8pvwl28aqklvq0hn7l8 instances, but I'm having some difficulty contacting the foreign ones.\n\nThese are the ones with the most users:\n\nhttps://write.otter.homes/read\nhttps://infosec.press/read\nhttps://blog.liberta.vip/read\nhttps://write.tedomum.net/read\nhttps://val-vgms.gay/read\nhttps://bolha.blog/read\n\nBut there are many others.Is there anyone among you who can try this or at least spread the word?Note: As I mentioned, the vulnerability has been known for a long time and is currently being exploited on a large scale.\n\nhttps://github.com/writefreely/writefreely/issues/1649",
"sig": "91cc1b6cb1098443dfd974ca2e04be3c5846f5e30a9ca3b88a34fc4f8daa38da629b9613cd518dad500422f932680d721dd68695a063879eea76f0f38579ce92"
}