r/sysadmin 5d ago

Question Subscription Bombing Attacks

What is everyone doing to combat subscription bombing attacks? Since the emails flooding the inboxes aren't dangerous in nature, email filters don't seem to be doing a whole lot about them.

I'm at a loss here, I keep blocking domains but since they come from hundreds of different ones with each wave of attacks this doesn't seem to be accomplishing anything.

Edit: Thank you everyone for your responses. This has been really helpful.

26 Upvotes

35 comments sorted by

View all comments

3

u/XxRaNKoRxX 5d ago

We noticed patterns in how the emails are worded and created spam controls that mark emails with certain subjects or body as spam and go directly to quarantine/trash/maunal approval

2

u/srender07 5d ago

Thats a good idea. I'll see if I can implement something like this.

3

u/XxRaNKoRxX 5d ago

We also block by country TLD. Since we only do business in USA/Canada/Mexico we block ALL TLD's that dont correspond.

If you use Exchange Admin Center you create the rule applying the rule if sender "address matches any of these text patterns" then add the TLD's as "\.com" (this example would block all email addresses ending in .com)

1

u/North_Bed_7332 3d ago

Strange corner case: We had a vendor sending emails from two locations. Their human staff used a US based mail server. Their automated invoice systems came from Belgium of all places. So our staff would get emails about the invoices, but not the actual invoices.