New attack in progress
Judging by the bounce messages I’m seeing, somebody or somebodies are trying to sign up for accounts on my Mailman instance using fake email addresses. Can’t imagine what the end game is, other than annoying people with “please confirm your email address” emails when they use a real address.
-- Paul Tomblin
On Tue, Aug 4, 2026 at 5:17 PM Paul Tomblin via Mailman-users < mailman-users@mailman3.org> wrote:
Judging by the bounce messages I’m seeing, somebody or somebodies are trying to sign up for accounts on my Mailman instance using fake email addresses. Can’t imagine what the end game is, other than annoying people with “please confirm your email address” emails when they use a real address.
There are ways to play their game that was discussed here:
On my site, I use reCaptcha, but this solution is not portable without pain, so go with Anubis. If you aren't averse to pain then: 2. https://eu.kictanet.or.ke/~wash/mailman3-captcha-guide.html
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
I've been seeing this again the past week; it's a variant on classic joe-jobbing spam. I assume Mailman3 instances are being targeted because Postorius has no built-in defenses, so you can generate ~unlimited unsolicited messages once you index all public instances, and flood a victim's gmail (etc) account.
I looked into the debian patches for recaptcha, got frustrated, and deployed Anubis in a container in front of my Mailman instances. It took under an hour to learn, install, and test... as long as you're not allergic to catgirls it's the easiest solution.
--Jered
----- On Aug 4, 2026, at 10:42 AM, Washington Odhiambo via Mailman-users mailman-users@mailman3.org wrote:
On Tue, Aug 4, 2026 at 5:17 PM Paul Tomblin via Mailman-users < mailman-users@mailman3.org> wrote:
Judging by the bounce messages I’m seeing, somebody or somebodies are trying to sign up for accounts on my Mailman instance using fake email addresses. Can’t imagine what the end game is, other than annoying people with “please confirm your email address” emails when they use a real address.
There are ways to play their game that was discussed here:
On my site, I use reCaptcha, but this solution is not portable without pain, so go with Anubis. If you aren't averse to pain then: 2. https://eu.kictanet.or.ke/~wash/mailman3-captcha-guide.html
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
Mailman-users mailing list -- mailman-users@mailman3.org To unsubscribe send an email to mailman-users-leave@mailman3.org https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ Archived at: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/message/...
This message sent to jered@convivian.com
On 8/4/26 5:35 PM, Jered Floyd wrote:
I looked into the debian patches for recaptcha, got frustrated, and deployed Anubis in a container in front of my Mailman instances. It took under an hour to learn, install, and test... as long as you're not allergic to catgirls it's the easiest solution.
However it precludes accessing Mailman from a non-javascript enabled browser.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
On 2026-08-04 21:24:25 -0700 (-0700), Mark Sapiro wrote: [...]
However it precludes accessing Mailman from a non-javascript enabled browser.
Not entirely, it only forces certain clients to calculate and return hashes, mainly based on user agent strings. For example, I have Anubis in front of all my Postorius/Hyperkitty sites and have no problem accessing them with console-based browsers like lynx. In fact, it's the Javascript in Hyperkitty that makes it so I can't browse list archives that way, Anubis isn't stopping me at all.
Jeremy Stanley
participants (5)
-
Jered Floyd -
Jeremy Stanley -
Mark Sapiro -
Paul Tomblin -
Washington Odhiambo