I am also ‘Andrew’, the admin of this server. I’ll try to remember to only use this account for posting stuff.
lemmy.world recently updated from version 0.19.3 to 0.19.10. This change - for Lemmy communities to federate out posts with the community name as a hashtag - was introduced in 0.19.4, so that might be the other reason why this has only just become an issue for you.
The attacker seems to be the admin of those two instances. Both instances have their registrations closed.
The alternative theory would be that these instances had open registrations, but rightly closed registration down after the admins noticed the bots. chinese.lol is on 0.18.4 with an admin with a 2 year old account, lemmy.doesnotexist.club has an admin with a 1 year account, and it was also that instance that the ‘nicole’ person has used before. This downvote attack would need to be a long time in the planning for what you’re suggesting to be true.
I don’t think that blog author is male, btw.
I don’t know. It’s not something I’m familiar with - it might just default to saying ‘closed’ if it doesn’t have the data.
It’s interesting that the obvious bot accounts on those instances were set up in mid-March last year, so I’m guessing that these are somebody’s army that they’ve used before, but overplayed their hand when they turned it on the DonaldJMusk person. The admins can reasonably be blamed for setting up instances with open registrations and no protections and then forgetting about them, but I’d be wary of blaming them for being behind the attack directly. The ‘nicole’ person is unlikely to have used their own instance - it’s probably just someone with the same MO as whoever owns the bots, finding and exploiting vulnerable instances.