# Just had 50+ new users (spammers or troll accts?) sign up from Mailserver @ koiot.de

**URL:** <https://boards.straightdope.com/t/just-had-50-new-users-spammers-or-troll-accts-sign-up-from-mailserver-koiot-de/1030515>\
**Category:** About This Message Board\
**Created:** [May 31, 2026, 9:10pm UTC](https://boards.straightdope.com/t/just-had-50-new-users-spammers-or-troll-accts-sign-up-from-mailserver-koiot-de/1030515 "2026-05-31T21:10:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![What\_Exit](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/what_exit/32/10652_2.png) [@What\_Exit](https://boards.straightdope.com/u/What_Exit)\
**Post date:** [May 31, 2026, 9:10pm UTC](https://boards.straightdope.com/t/just-had-50-new-users-spammers-or-troll-accts-sign-up-from-mailserver-koiot-de/1030515/1 "2026-05-31T21:10:33Z")

</div>

Anyone know anything about this Email Server?

So the .de of course means Germany.  
It looks like the domain belongs to a German IT and Web Developer.  
This has the marks of an old school DOS attack (probably wouldn’t do any good these days) or more likely the prep for a raid. Do those still happen?

Apparently [koiot.de](http://koiot.de) is a play on the German word for Coyote.

---

<div class="post-metadata">

**Author:** ![Elmer\_J.Fudd](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/elmer_j.fudd/32/1211_2.png) [@Elmer\_J.Fudd](https://boards.straightdope.com/u/Elmer_J.Fudd)\
**Post date:** [June 1, 2026, 4:40am UTC](https://boards.straightdope.com/t/just-had-50-new-users-spammers-or-troll-accts-sign-up-from-mailserver-koiot-de/1030515/2 "2026-06-01T04:40:25Z")

</div>

This is likely part of an attack on the [koiot.de](http://koiot.de) mail server itself. 50 registrations at each of thousands of websites will deluge that server with incoming mail.

---

<div class="post-metadata">

**Author:** ![What\_Exit](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/what_exit/32/10652_2.png) [@What\_Exit](https://boards.straightdope.com/u/What_Exit)\
**Post date:** [June 1, 2026, 4:59pm UTC](https://boards.straightdope.com/t/just-had-50-new-users-spammers-or-troll-accts-sign-up-from-mailserver-koiot-de/1030515/3 "2026-06-01T16:59:53Z")

</div>

And they’re still rolling in, though from 3 or 4 different domains.

We might need to see about shutting off new sign-ups for a few days or restricting email domains.

[@moderators](https://boards.straightdope.com/groups/moderators)

---

<div class="post-metadata">

**Author:** ![Pleonast](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pleonast/32/1183_2.png) [@Pleonast](https://boards.straightdope.com/u/Pleonast)\
**Post date:** [June 2, 2026, 12:03pm UTC](https://boards.straightdope.com/t/just-had-50-new-users-spammers-or-troll-accts-sign-up-from-mailserver-koiot-de/1030515/4 "2026-06-02T12:03:30Z")

</div>

> [@What\_Exit](#):
>
> We might need to see about shutting off new sign-ups for a few days or restricting email domains.

You’ll also need a long term solution. This may be the new normal.

---

<div class="post-metadata">

**Author:** ![ParallelLines](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/parallellines/32/3575_2.png) [@ParallelLines](https://boards.straightdope.com/u/ParallelLines)\
**Post date:** [June 2, 2026, 8:56pm UTC](https://boards.straightdope.com/t/just-had-50-new-users-spammers-or-troll-accts-sign-up-from-mailserver-koiot-de/1030515/5 "2026-06-02T20:56:36Z")

</div>

We’re trying a few behind the scenes options, but as always, it’ll depend on if it’s an evolving, rotating series of sources, or a spike that’ll subside.

The first is indeed the sort of a new “normal” as you mention.