I've been seeing this again the past week; it's a variant on classic joe-jobbing spam. I assume Mailman3 instances are being targeted because Postorius has no built-in defenses, so you can generate ~unlimited unsolicited messages once you index all public instances, and flood a victim's gmail (etc) account.
I looked into the debian patches for recaptcha, got frustrated, and deployed Anubis in a container in front of my Mailman instances. It took under an hour to learn, install, and test... as long as you're not allergic to catgirls it's the easiest solution.
--Jered
----- On Aug 4, 2026, at 10:42 AM, Washington Odhiambo via Mailman-users mailman-users@mailman3.org wrote:
On Tue, Aug 4, 2026 at 5:17 PM Paul Tomblin via Mailman-users < mailman-users@mailman3.org> wrote:
Judging by the bounce messages I’m seeing, somebody or somebodies are trying to sign up for accounts on my Mailman instance using fake email addresses. Can’t imagine what the end game is, other than annoying people with “please confirm your email address” emails when they use a real address.
There are ways to play their game that was discussed here:
On my site, I use reCaptcha, but this solution is not portable without pain, so go with Anubis. If you aren't averse to pain then: 2. https://eu.kictanet.or.ke/~wash/mailman3-captcha-guide.html
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
Mailman-users mailing list -- mailman-users@mailman3.org To unsubscribe send an email to mailman-users-leave@mailman3.org https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ Archived at: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/message/...
This message sent to jered@convivian.com