sounds like a sign up bomb for github addresses, these are typically used to hide new login notifications by threat actors

Huh. I thought this was targeted to me in particular, because it started coming up with new aliases at my Firefox Relay subdomain, and then only once I started blocking them it started using plus-addressing on my gmail. Annoying.

They're being used to hit addresses of mine exposed to Discord and GitHub. Catch-all had the names of two people in the news, oddly, as well. Hint: 1,000 bottle delivery to an island.

Yeah same here, specifically on my (public) GitHub email address

I'm getting emails titled "Activate account for ...", and addressed to random names of web services at my domain (e.g. reddit@example.org). Also Twitch-related names like pog, kekw and xqc.

Also super annoying are crypto scams sent from an Italian ISP's (tiscali.it, shame on you) email service, even though I tried to contact the ISP, but that's unrelated to this.

I've also received about 40 messages, on mail adresses I've never used before.

Same here, I removed my email address from Github and all other public pages

I got about 50 of these this morning and thought it was a disgruntled HN user.

weirdly i have 10+ wild card domains and some very public emails (websites with nothing to prevent bots) yet i’ve not gotten even one?

Received 15+ in 10mins on a public email (dropbox, soundcloud, gitlab, tidelift etc). Then just started hitting handles on the domain ( diddy@, epstein@ ). Just placing an aggressive block for "Activate account" and "zendesk" in content for now