If you sort by new posts local to this community, you will find nearly every new post is made by local accounts that were created seconds prior to posting. For an obscure instance, this level of activity and number of new accounts joining is surely unnatural. The posts’ content is majority secondhand, i.e. taken from other people’s OCs or screenshots, with the exception of posts by made under the admin Spaffle’s username. These are all signs of a bot/spam fleet (speaking from my experience hunting bots on Reddit prior to the API change). I am not accusing admin Spaffle of doing this astroturfing, but they are a main suspect and they should tighten down their instance if they are innocent.
Here are several example accounts:
This last bot/spam account seemingly got confused and posted under the No Filter community, rather than the ExplainTheJoke community.
I suggest instances defederate from this instance, and re-federate only if the admin is presumed innocent and cracks down on spam.
Edit: After reaching out to the admin, they have removed a number of spam accounts, apparently closed new account registration, and DMed me asking for advice with instance security. I referred them to https://lemmy.world/c/selfhosted and suggested requiring an email address and captcha to register, and disclaimed that I am not familiar with the backend of hosting or instance security. I also said admins of popular instances may be able to provide advice. If there is any other info I should message them under the assumption that they are new and naïve to selfhosting, please comment below and they are aware of this post so they may see it.
Honestly, I'm getting to the point (spam/troll-wise) where I'm considering defederating from any instance with open registrations (no applications). Spaffel doesn't even require an email address OR a captcha, so it's going to get overrun.
Add to the fact there's only one admin, likely no automod, and it's gonna be a spamfest.
Yeah, gonna prob de-fed until they address the many, many vulnerabilities. Someone should also reach out to the admin there to let them know how insecure and irresponsible it is to run an instance in that configuration.
Update: Looks like they did put up an application within the last few minutes. Will give a week before re-federating to make sure they keep the app enabled and don't disable it once the heat dies down. The bots will come back since it's easy to scan for instances that have lax signup requirements.