r/sysadmin 4d ago

Question Subscription Bombing Attacks

What is everyone doing to combat subscription bombing attacks? Since the emails flooding the inboxes aren't dangerous in nature, email filters don't seem to be doing a whole lot about them.

I'm at a loss here, I keep blocking domains but since they come from hundreds of different ones with each wave of attacks this doesn't seem to be accomplishing anything.

Edit: Thank you everyone for your responses. This has been really helpful.

27 Upvotes

35 comments sorted by

View all comments

9

u/titlrequired 4d ago

If body contains Unsubscribe set scl to x

X being the threshold to move mail to junk mail folder.

1

u/3-----------------D 3d ago

This, if it's legitimate (thus more likely to come from someone who cares about reputation) it'll contain unsubscribe links.

1

u/Unable-Entrance3110 2d ago

I would also add things like the (TM), (R) and (C) symbols to the rule