Does anyone know how I can reject all applications at once? Via the UI I can only reject 100 at a time

I've also been getting lots of similar spam on Lemmy, with almost the exact same application message. I assume they're related.

Is there an API? That would be the best option.

Can you enable a captcha for registration application?

This is the email bomb protocol. This person creates a ton of accounts at different Fediverse servers and probably other applications, using the same email address on each, so the owner of the email gets pounded with emails. This is to cover up or make it impossible for the person to see that their bank account or whatever has been compromised and to prevent recovery.

Eventually the email provider protects itself by rate limiting the incoming emails so they aren't even seen. This causes the SMTP servers to continue trying to send the emails due to the temporary failure, generating even more email.

Ultimately the email provider will shut down the email address, and that poor person cannot see any of the emails sent by the bank with warnings or account instructions, and it certainly delays recovery until all the assets are removed from the account.

You should close registrations or at least require approval.

I don't know how it works on Peertube, but on Mastodon, the email validation is sent even if approvals are required, so it doesn't stop the bombing.

You can check your logs for some way to recognize the incoming requests and set up a firewall rule if you have access to a firewall that can do this.

Wow, that's pretty malicious, and good to know about

Oh shit, I think that's why emails from my domain have been going to spam lately. I guess I fucked up my reputation with gmail. Currently registrations require approval, but they still send an email verification link. Maybe I'll just close them. Thank you so much for pointing this out!

I read it as sperm applications. I had a lot of questions.

gregtech.eu, the premier sperm bank. We take only the best.

Wouldn't it be enough to send the verification after the approval?

I guess the asshole moved on from my instance to yours, after I enabled admin approval of accounts. Sorry 😅

I use mxroute. In my case, I'm able to specify an SMTP connection to use for forum registrations, so I set up noreply.[domain.ext] and pointed the MX records to mxroute. You can use the cheapest plan which IIRC used to be $10/yr if you caught a discount (locked in price).

One of the nice things is that they detect email addresses used to spam signups, so it won't even send an email - which means they can't confirm the account.

But also, emails via mxroute don't end up in spam in my experience.

All that said, doesn't prevent account creation, just emails in spam and account confirmation.

If that's not useeful, my apologies and do ignore me :)

From which mail server do you send the emails from? Use something like SMTP2GO.

Granted one of those providers (if reputable) almost certainly would have shut down his account and flagged it for sending spam messages to prevent their IP blocks from receiving lowered reputation

Damn, doesn't peertube have built in rate limiting turned on by default?

nah, the guy is spamming the whole fediverse for weeks now

I turned off registrations on mine, and instead ask people to use the contact form.