@liaizon fwiw, authorized fetch is only going to stop another signed activitypub request if you have the domain suspended or operate on an allow list. Any legitimate AP request that is signed will go through otherwise.
I feel like they are pulling from mastodon.social's API streaming endpoint. So posts that end up on m.s' federated timeline are going to end up on there
@witchy @djsundog @t54r4n1 ah yeah that makes sense, thanks