Subscription Bombing Turns Small Business Signup Forms Into Weapons

A crash course in subscription bombing. Over the past several weeks, the Commonwealth Sentinel website’s contact form has received a steady stream of submissions with the same odd fingerprints. The name and company never match the Gmail address, the phone number always begins with (202) 555, the visitor always says they heard about us on LinkedIn, and the box to join our email list is always checked.

Those entries were not written by people interested in cyber security. Automated programs, commonly called bots, filled them in, and the email addresses belong to real people who have likely never heard of us. The practice is called subscription bombing, and it is one reason Commonwealth Sentinel reviews every new subscriber by hand before anyone receives a message from us.

How the scheme works

The phone number is the easiest tell. Numbers from 555-0100 through 555-0199 are reserved for movies and television, and the 555 exchange is rarely assigned to a real home or business line, so a bot that needs a plausible-looking number will reach for it.

The bots search the internet for sign-up forms that lack a verification step, then enter one victim’s address into hundreds or thousands of them at once. Proofpoint, an email security company, reported in December 2025 that a single attack can deliver more than 1,500 emails an hour. Because each message comes from a legitimate business, ordinary spam filters often let the flood straight through.

The goal is to bury something the victim needs to see, such as a bank notice about a wire transfer, a password reset, or a receipt for a purchase made with a stolen card. Criminals also use the flood as cover for a second scam. The same Proofpoint report describes the ransomware group Black Basta flooding inboxes, then reaching out on Microsoft Teams while posing as the IT help desk, offering to fix the spam and persuading victims to install remote access software.

What it costs the business whose form was used

For the organization whose form was misused, the harm is quieter but still real. The people on the other end never asked to hear from you, so they ignore the messages, unsubscribe, or mark them as spam, and each of those choices counts against your sending reputation.

Open rates fall, unsubscribes climb, and complaints pile up against your domain. Since February 2024, Google has required bulk senders to keep spam complaint rates below 0.3 percent, and a list padded with strangers can cross that line quickly. Once major email providers decide a sender is unwelcome, newsletters start landing in real customers’ spam folders, and many email marketing platforms charge by the number of contacts, so the business pays to annoy people.

What website owners can do?

Most fixes are already built into common website form tools, and none require a large budget. We recommend five steps for any small business, local government, or non-profit with a public sign-up form:

1. Add a verification check, such as Cloudflare Turnstile or Google reCAPTCHA, that quietly separates people from bots and usually asks real visitors for nothing.
2. Turn on a honeypot field, a hidden box people never see, but bots fill in, so the form can automatically reject those entries.
3. Use double opt-in, meaning a new subscriber must click a confirmation email before you add them to the list, so a stranger’s address never becomes a contact.
4. Review new sign-ups before the next send, and remove entries with mismatched names, 555 numbers, or repeated answers across many submissions.
5. Check whether the consent box on your form feeds straight into your email platform, and purge any suspicious contacts there rather than mailing them first.

What to do if your inbox is suddenly flooded

When dozens of newsletter confirmations arrive within an hour, treat the flood as a warning sign rather than a nuisance. The email itself is rarely the danger, but it often means someone is trying to hide a message while they act on one of your accounts.

1. Log in to your bank, credit card, and key accounts directly by typing the address or calling the number on the back of the card, and look for transfers, purchases, or changed settings.
2. Search the flood for password resets, order confirmations, and security alerts, since those are the messages the attacker wanted you to miss.
3. Refuse help from anyone who calls, texts, or messages offering to clean up the spam, and contact your own IT support through a number you already have on file.
4. Change your email password and turn on multifactor authentication, a second login step beyond a password, if it isn’t already in place.
5. Report any money lost to the FBI’s Internet Crime Complaint Center at ic3.gov, and call your bank the same day.

The flood usually tapers off within a few days. Filtering rules and the report spam button will clear most of it in the meantime, and clicking hundreds of unsubscribe links one by one is rarely a good use of anyone’s afternoon.

Where Commonwealth Sentinel fits

Commonwealth Sentinel offers email protection for small businesses, local governments, and non-profits across the Commonwealth, screening incoming mail for phishing and other threats before it reaches staff. We also help offices set up the form safeguards described above so their websites aren’t used against someone else. Owners and officials who want to talk through their setup can reach us at 502-234-5554, and we can start by where the office stands today.

A sign-up form is an open door to the public, and like any door on Main Street, it works best when someone is paying attention to who walks through it.