What I learned when spammers found my newsletter form

I've been reading newsletters for a while now. We all have. It's a great way to get information delivered to you about stuff that you like, or services that you use.

Recently I launched my own and it gave me a nice perspective on the "other side" of newsletters, with its own set of challenges. I know it's hard to deliver email properly because providers need to protect us from SPAM, but I didn't know it was that hard.

Another difficult thing to maintain on a site is the "user facing stuff", like contact forms, comments, etc. Anything where people can insert data, spammers will find a way to submit SPAM. That's why I have comments being manually validated before submitting them on the site. I don't want to have SPAM and worse yet, fraud.

But recently I noticed in my mailbox emails arriving from newsletters that I didn't subscribe to. I thought that some "growth hackers" found my email online and it was a good way to increase their newsletter numbers, but it was not that.

Only when I launched my own newsletter did I understand that that's not 100% the case every time.

So let's explore this and see what's happening.

Spammers are attacking through you, not you

I noticed that in a few hours I had a lot of subscriptions to the newsletter. There were a lot of Gmail emails but also other domains (like companies for example).

Growth is good, but since this was not expected, I started looking at the logs and found that a lot of the subscriptions were done from the same IP (or similar groups of IPs).

When I checked the emails, they looked legitimate. So what was happening?

Apparently spammers can use your email and subscribe you to hundreds of newsletter subscription sites, so that you are bombarded with legitimate newsletter traffic. So legitimate businesses send the victim a lot of legitimate email that they didn't subscribe to, turning the businesses into victims as well.

So now that you have a lot of emails, here comes the second part of the attack.

The "why" they do it

Like everything, if someone does something, it's because they can benefit from it, so why are they doing this?

While taking a look online I found a few strategies to take advantage of this.

The friendly IT trying to help

The first thing that they can do is to call you and say "I'm from IT and I noticed that you've been receiving a lot of unwanted emails". And that's true. You are.

They will ask you to install software on your computer to check what's wrong and that's where you can have problems. They can take away money from your account or wallets, get your personal information, etc.

So they build artificial danger and credibility beforehand so that you can "trust them" when they call.

Always be super suspicious when people call you, because you have no way to know who they are. Even if they know your information, don't trust them since your information most likely is available online for anyone to find.

Bury the email that has the fraud

Another strategy is to send a lot of these emails so that you have a lot of them to process. In the middle of these emails you'll see an email "Bank alert", "Invoice not paid" or "account confirmation". A person can think that their account was hacked because of all this SPAM and click the email without thinking.

Be calm when looking at these emails because most of the time things are not "pay now or you'll be in trouble" like these emails make you think. Usually real services will send you multiple emails before. So don't click on the links and go to the site or service directly in your browser.

I will say it again because it's important. Never click the buttons in the email, go to the site yourself. The links are made to look like they are legitimate sites and they will take away your data and money, so be careful.

Denial of service if the volume is high enough

It needs to be quite high, but if the number of emails starts to get high then the mail server could start rejecting real email and this could have a huge impact to businesses. So it's a cheap way to bury real emails by using someone else's infrastructure, or worse yet, get you flagged as a spammer.

Trying to get a site / service flagged in the email services

If you get 0.3% of the emails you send flagged as spam by people, all emails will go to SPAM. And there's not a lot that you can do to recover from this. So spammers could try to get you flagged in Yahoo or Gmail and therefore make you disappear from people's inboxes. The impact is huge.

It's not only newsletters, it's anything that sends emails

I've mentioned the newsletter box that is an easy target since the sites that have them promote them heavily making them available on most pages so they are easy to find.

But other forms could be used and even account creation or "forgot password" could be used. In platforms where these strategies are quite well known like WordPress for example, they can heavily automate things if the site is not protected properly.

Another example is the contact form. A lot of sites have them and the fields are mostly the same. So automation is easier.

Everyone loses

If someone starts sending emails in my name, then my reputation goes down because people will start flagging my emails as "spam", making my real emails hard to deliver.

Another impact to the services that send emails is cost. Emails cost money to send and if things are not well protected, thousands of emails per hour can be sent.

So what sites do is to implement those horrible CAPTCHAs or pay companies to validate the traffic for them. More costs and infrastructure burden to protect yourself.

My mistake and what I did right

The newsletter had a double opt-in, so this means that I would send you an email saying "we got a request for this email but if it's not you ignore this". It still sends one email and you can still mark it as SPAM (like some people did), but it avoids that when I send the newsletter out people will receive the emails.

It was easy to clean because all emails that were sent were not validated, so I deleted them and that's it.

To fix the issue I implemented an invisible CAPTCHA that will validate the requests. I don't like to force people to watch traffic lights so an "invisible" + "privacy focused" strategy was the ideal solution for me. As soon as I deployed the number of spam requests disappeared completely. Real requests still go through (I tested) but some emails are being delivered to SPAM because my ratio of emails being sent is high (a few submissions for not a lot of emails sent will be more than 0.3%).

I will recover but that's the solution. Google CAPTCHA is ugly but it works, or if you want the same solution that I use there's ALTCHA. Google CAPTCHA stores cookies and I don't like that, so this solution looks a lot better.

Also worth pointing out that there are solutions to get around CAPTCHA and this is a cat-and-mouse game, but this will at least block a lot of the "low effort" cases where they just want to send as many emails as possible to people.

Final Thoughts

I'm leaving a few sources below for things that could be useful to you in case you want technical details or understand what you can do to avoid this.

Doing the implementation yourself is a great way to learn and especially to catch these cases where people are trying to do nasty stuff and finding solutions for them.

So if you have a site, try installing something that blocks automatic posting like the one I installed and if you receive these emails, don't blame the service that sent them. It's possible that it's not their fault.

As for the emails you receive, don't react to them quickly. Notice patterns and things that "don't make sense". I also have an article about a SPAM email that I received recently, in case you're interested. The signs are there.

Sources

• Mathias Payer and Candid Wuest, Subscription Bombing: Email Under Attack, Communications of the ACM, January 2026. The free full text is on EPFL's site. An analysis of 24 real campaigns totalling 46,970 unwanted emails, and the source for the volume, timing and pricing figures.
• Spamhaus, Subscription Bombing: COI, CAPTCHA and the next generation of mail bombs. The 2016 attack wave, and why confirmed opt-in on its own was not enough.
• M3AAWG, Recommends adding new email header to mitigate list bomb attacks from subscription sign-up forms.
• Proofpoint, How subscription bombing hides real cyberattacks.
• ReliaQuest, Black Basta social engineering technique using Microsoft Teams. The inbox flood followed by the fake IT helpdesk call.
• CISA and FBI, #StopRansomware: Black Basta, joint advisory AA24-131A.
• Spam Resource, Signup best practices: banning bots and NHI. On bots that happily click the confirmation link.
• Suped, What are the purposes of bots signing up for emails and accounts on websites.
• BigMailer, List bombing, what it is and how to prevent it. What the attack costs the site that got used as the amplifier.
• ALTCHA, Proof of work CAPTCHA, and Postmark, When spambots attack.

Photo by Markus Spiske on Unsplash