Understanding Subscription Bombing

Subscription bombing is a malicious attack where automated bots, or "spambots," flood your website forms with fraudulent sign-ups. This can severely damage your sending reputation, overwhelm your database with useless data, and harass legitimate individuals.

Tip: Are you looking for information about Constant Contact’s Email and Digital Marketing product? This article is for Constant Contact’s Lead Gen & CRM product. Head on over to the Email and Digital Marketing articles by clicking here. Not sure what the difference is? Read this article.

What is Subscription Bombing

Subscription bombing (also known as form abuse, list bombing, or mail-bombing) is an automated attack where spambots submit fake or unauthorized information to your online forms en masse.

The intended use of subscription bombing can include:

• Harassment: Flooding an individual's inbox with form-fill confirmation emails.
• Reputation Damage: Intentionally harming your company's sending reputation by triggering spam complaints and high bounce rates.
• Distraction: Masking a legitimate account alert (like a password change confirmation) within a flood of junk mail, hoping the recipient misses it.
• Denial-of-Service (DoS): Overwhelming your systems or your Email Service Provider (ESP) with a high volume of traffic and email sends to start a Denial-of-Service (DoS) attack. 

Potential Hazards

An unchecked form abuse attack can have severe and lasting consequences for your email marketing efforts. The chain reaction of damage includes:

List Contamination: Your contact lists are flooded with thousands of fraudulent email addresses, leading to wasted resources and skewed analytics. Sending to these fake addresses results in a surge of spam complaints, spam trap hits, unsubscribes, and hard bounces.

Reputation Damage: Internet Service Providers (ISPs) like Gmail and Yahoo interpret these negative metrics as a sign that you are sending spam. Your sending IP address can be blocked or blacklisted by major ISPs, crippling your ability to deliver emails to legitimate customers and leads.

Protecting Yourself

You have several powerful tools to defend against subscription bombing. Proactive protection is the best strategy.

• Enforce reCAPTCHA: This is your strongest defense. Spambots cannot easily solve reCAPTCHA challenges. Lead Gen & CRM forms allow you to enable either Invisible reCAPTCHA (which only challenges suspicious traffic) or Forced reCAPTCHA (which challenges every submission).
  
  Note: This protection applies only to native Lead Gen & CRM forms. If you use third-party forms, you must implement a similar security feature on that platform.

• Use hidden fields.  A hidden field is a form field that is invisible to human users but visible to bots. If this hidden field is filled out, you'll be able to identify the submission as spam. 

• Use opt-in methods, such as double opt-in. Your leads need to confirm that they want to receive your content, known as opting in. This is normally done by having leads click a link to confirm that they want to remain subscribed to your emails. If you have a subscription bombing event, only the confirmation email will be sent. This minimizes the risk of repeated email sends to fraudulent email sign-ups. 

• Look for data abnormalities. Watch for data abnormalities. Spambot activity often includes:

  • Gibberish names (e.g., "jdfg sdfg").

  • A sudden influx of sign-ups from domains in countries you don't serve.

  • A rapid, unnatural spike in submissions over a short period.

   

When Events Occur

If you suspect your forms are under a subscription bombing attack, act immediately to mitigate the damage. Follow these steps:

1. Pause Key Automations: Immediately pause all automations that uses the trigger 'when a lead fills out a form'. This will stop new emails from being sent to the fraudulent addresses.
2. Secure Your Forms: Enable Forced reCAPTCHA on all public-facing forms to block further bot submissions.
3. Clean Your List: Identify and delete the fraudulent form sign-ups from your database. Look for contacts added during the time of the attack.
4. Communicate: Contact your ISP. 

Doing this during a subscription bombing event will help to prevent further submissions and email sends. Only after you have cleaned out your database and secured your email forms should you restart your forms and automation events.

Contact Support for more information on modifying Lead Gen & CRM settings or disabling features during a subscription bombing event.

Questions?