iiinova — where your digital self keeps evolving

SentryBot @sentrybot.excessive.space · 27/09/2026

Me: *trying to create an @ovhcloudus.bsky.social account* OVH Cloud:

The user is trying to create an OVH Cloud account with a password that is a gibberish of randomly generated by KeePass that contains mostly Latin supplemental characters and is 32 bytes long.

OVH Cloud's password checker is saying "This password is too easy to guess and could not be used. Please change your password and try again."

The password is similar to: àÇ±E4rùµ6ó§ÄÃ:±Ã$ª<ç5çç0RÙ¸v`wçº

For anyone thinking of trying to hack my account, neither this password nor the one in the image is my actual password.

000

SentryBot @sentrybot.excessive.space · 18/09/2026

Now we just have to do the work!

Gotta do some processing on the image_format and image_mime, because either could be null and their case might be weird. We also have a generic and easy-to-add-to list of forbidden formats.

Then a nice quick loop that checks each format to see if it is present. If they are, it throws a custom exception.

100

SentryBot @sentrybot.excessive.space · 18/09/2026

We need to stop it doing any conversion, so let's just throw in what we hope will work:

Now with added "check the format" call! Oooh. Shiny!

100

SentryBot @sentrybot.excessive.space · 18/09/2026

This is how I currently process images into png files. This is all happening in RAM, because the hard drive is lava when you are hard-enforcing "no private data storage".

Simple Python code that prepares a buffer, opens an image with Wand/ImageMagick, converts it to PNG, and saves it to the buffer. So simple...

100

SentryBot @sentrybot.excessive.space · 05/09/2026

"But Damaged!" I hear you ask. "Why not use this method to catch crypto scam images too?" That is a thorny one. Let me explain! The two images here are of the OCR of two different images. One is a scam image, the other is a meme of the scam format. We want to get the scam, but not the meme.

The text:

"The image contains two distinct parts: a computer screen showing a social media post from MrBeast and a smartphone displaying a cryptocurrency withdrawal screen. The computer screen shows a post from MrBeast, titled “Beast Games Strong vs Smart Is Out Now!”, with engagement metrics including likes, comments, and shares. The post is attributed to “@MrBeast” with timestamp 7:45 PM on April 14, 2014. The post has 2,303 followers and includes 34,771 followers. The phone screen displays a cryptocurrency withdrawal interface showing a successful withdrawal of $5600.00, with details including the amount transferred, recipient address, and transaction ID. The interface includes options for selecting a withdrawal method, choosing between crypto or bank transfer, and viewing transaction history. The phone screen also shows transaction details such as amount, recipient address, and transaction ID."

$The text: "The image contains OCR text from multiple sources:\n\n1. **Left side:** A computer screen displays a Twitter profile for Mr.Beast (@MrBeast), showing his profile picture, tweet, follower count, and OCR text: “Beast Games Strong Vs Smart Is Out Now! Joined April 2014. 2,301 Following. 34.7M followers. Subscriptions. Not followed by anyone you’re following.”\n\n2. **Middle:** A computer screen shows OCR text: “Your Employer JOB Withdrawal Success! Paycheck $3500 Was Successfully The money will be transferred to your specified wallet. Continue.”\n\n3. **Right side:** A smartphone screen displays a payment screen showing a green checkmark and text: “$3500 Bossman.” A green button labeled “Continue” is also visible. The phone screen shows OCR text: “View on Block Explorer.”\n\nThe OCR text is consistent across all three sources, capturing various details like names, dates, job titles, and payment amounts."$

101

SentryBot @sentrybot.excessive.space · 05/09/2026

This, with a little more processing of text output, will give:

$The text: "I’ll help the first 10 people interested on how to start earning $200k or more within a week, but you will reimburse me 10% of your profits when you receive it.\n\nNote: only interested people should send a friend request or send me a dm! ask me (HOW) via Telegram username\n\nOr use the telegram link in my bio"$

100

SentryBot @sentrybot.excessive.space · 05/09/2026

A proof of concept code snippet:

$The following Python Worker code: async def ocr(self, request: Request) -> Response: image_url = "https://cdn.discordapp.com/attachments/160386989819035648/1545680353283407932/image.png?ex=6a9d0681&is=6a9bb501&hm=37807f6a6697e7f38d7a08f720769104c02c3c3cb280aed6db7219a7db50dc3a&" image_response = await pyfetch(image_url) blob = await image_response.blob() array_buffer = await blob.arrayBuffer() python_bytes = array_buffer.to_py().tobytes() base64_encoded = base64.b64encode(python_bytes).decode('utf-8') ocr_default = { "task": "query", "question": "OCR this image", "temperature": 0.0, "reasoning": False } ocr_default["image"] = f"data:image/png;base64,{base64_encoded}" answer = await self.env.AI.run('@cf/moondream/moondream3.1-9B-A2B', ocr_default) return Response(answer, headers={"content-type": "text/plain;charset=UTF-8"}, status=200)$

100

SentryBot @sentrybot.excessive.space · 05/09/2026

Scammers are mostly doing the same ol'-same ol'. Have seen the first of something different. Scammers using images of text to get around regular moderation tools for text. Example (cropped and edited to remove the scammer):

101

SentryBot @sentrybot.excessive.space · 13/07/2026

Ooooh. Looks like our friendly neighborhood crypto-scammers have come up with a new trick to avoid picking up reused images: they stitch them together! Oh no! What am I to do? How will I defeat the— Oh. I guess I could just use @opencv.bsky.social and split them apart. Yeah, that'd work.

141

SentryBot @sentrybot.excessive.space · 10/07/2026

Regarding the "Personal Information" snippet in the title (and on the banner of the bot): it is (of course) an xkcd comic xkcd.com/1998/ Alt text: By clicking anywhere, scrolling, or closing this notification, you agree to be legally bound by the witch Sycorax within a cloven pine.

A humorous Privacy Policy, detailing the chaotic nature of modern privacy.

000

SentryBot @sentrybot.excessive.space · 07/07/2026

- They appear to be getting more persistent - They don't seem to be using hijacked accounts (maybe that was another attacker I just haven't seen lately?) A couple of wins for the day (:

A discord server's Audit Log showing SentryBot timing a spammer out for 12 hours (yes, I have fixed this, it shouldn't make so many entries anymore).

A screenshot of a server's quarantine channel where SentryBot banned a spammer and deleted all their messages, helpfully letting mods know it did so.

010