I have been receiving confirmation messages for subscription requests from Mailman-based mailing lists at a variety of domains, mostly academic. Some of these lists aren't even public, according to the Mailman web interface at the corresponding domains, which makes me wonder how the attacker is finding them. The vast majority of these malicious subscription requests are coming from 91.90.120.173. Is anyone else getting confirmation emails like these? Are any Mailman list administrators here seeing this attack?