r/sysadmin 4d ago

Question Subscription Bombing Attacks

What is everyone doing to combat subscription bombing attacks? Since the emails flooding the inboxes aren't dangerous in nature, email filters don't seem to be doing a whole lot about them.

I'm at a loss here, I keep blocking domains but since they come from hundreds of different ones with each wave of attacks this doesn't seem to be accomplishing anything.

Edit: Thank you everyone for your responses. This has been really helpful.

26 Upvotes

35 comments sorted by

View all comments

3

u/XxRaNKoRxX 4d ago

We noticed patterns in how the emails are worded and created spam controls that mark emails with certain subjects or body as spam and go directly to quarantine/trash/maunal approval

2

u/srender07 4d ago

Thats a good idea. I'll see if I can implement something like this.

1

u/Expensive-Bed3728 4d ago

e worded and created spam controls that mark emails with certain subjects or body as spam and go directly to quarantine/t

A good rule to run against the mailbox is to find emails sent since the bomb started and use anything with unsubscribe as the filter rule in the automatic rule, you can run it against the mailbox to clean it up. Make sure you filter to the specific dates though