Understanding list bombing and how to remove fake profiles

You will learn

Learn how to recognize list bombing attacks, reduce malicious signups, and identify and suppress suspicious email profiles to protect your lists and sender reputation.

What is list bombing?

List bombing is a malicious attack where the attacker exploits a signup form or checkout page by making a large number of fake submissions, filling the associated list with emails and phone numbers that have not consented or are invalid. While an increase in email subscribers may initially seem like a good thing for your brand, this is only true if all the new leads are legitimate.

If you send to fake profiles created through a list bombing attack, it can negatively impact your deliverability in the following ways:

• Higher hard bounce rates
• Higher spam complaints
• Lower open rates
• Negative impact to sender reputation
• Potential spam trap hits
• Potential blocklisting resulting in blocked email traffic

Not all profiles submitted as part of a list bombing attack are fake email addresses. Bots can fill out forms with real email addresses, and profiles of people who have no knowledge of this are being added to marketing lists. When a company sends emails to mass amounts of profiles submitted by bots, many of them mark the email as spam.

Bots commonly target the following forms and entry points. This is not an exhaustive list; bots can submit profiles anywhere there is an unprotected form:

• Ecommerce checkouts
  Bots have been observed, especially for customers using an ecommerce platform (such as Shopify). The bots can start a checkout and abandon it using a real person’s email, and the event will sync to Klaviyo.
• Home page footer form
  Footer forms on a home page that collect email addresses and no other information have been a specific target of bots.
• Coupon codes (“$$OFF”, or “%OFF”) on the home page
  Bots target these forms specifically to get coupon codes which they later put on coupon / promo code websites to drive website visits to those pages.
• Forms without CAPTCHA
  Forms without CAPTCHA are susceptible to bots filling them out.
• API
  Bot submissions can be collected through third-party forms and synced to Klaviyo through the public API.

How to identify a list bombing attack

The first indicator of list bombing is if you've experienced a sudden spike in new subscribers. This is particularly true if you haven't planned any list growth campaigns, so there is nothing to tie this spike to. If this happens, examine the recent email subscribers, looking out for the following trends:

• The emails all came in through a single point of entry (e.g., same signup form)
• There was a specific timeframe in which the influx of emails was captured
• All the emails are from the same domain (e.g., all are from @phish.com)
• The contacts have unconventional first and last names
• All submissions are from the same IP source

How do you protect against list bombing?

CAPTCHA in forms

CAPTCHA is a tool that requires form submitters to complete a short task to verify that they are a real person and not a bot. When Klaviyo detects suspicious behavior or historical bot activity from a user’s IP address, they will be prompted to solve a CAPTCHA.

This functionality is automatically enabled for Klaviyo signup forms that collect email or SMS leads or request a unique coupon code. Only visitors whose activity is flagged as suspicious are prompted to complete the CAPTCHA.

Double opt-in

Double opt-in requires a new subscriber to confirm their subscription before being added to a list. It is used for both email and SMS subscriptions. Double opt-in is on by default, but you can change a list’s opt-in setting. Check each affected list’s settings before relying on this protection.

When double opt-in is enabled, new subscribers will receive a confirmation message immediately after signing up. This message will prompt them to confirm their subscription. Only subscribers who confirm their subscription will be successfully added to the list, making it harder for malicious actors to list bomb.

To enable double opt-in for a list:

1. Open the list and select Settings > Consent.
2. Select Double opt-in.
3. Click Save.

List bombing IP management

Klaviyo’s list bombing IP protections flag or block IP addresses that make a large number of form submissions or client subscription API calls within a short period of time. These protections help limit further subscriptions from a flagged IP address.

Note that the IP blocking only occurs after the attack has already started to protect your account from further harm. This method of list bombing mitigation cannot prevent an attack entirely.

Honeypot form field

Adding a “honeypot” field to a website’s form is a method you can implement to easily identify if you are being list bombed. If you are using a custom, non-Klaviyo form, you can place a hidden field that is invisible on the front-end. If the form is submitted with a value set for the honeypot field, you can attribute the submission to a bot rather than a human user.

Make sure that your honeypot adds a custom property to Klaviyo that you do not plan on using anywhere else. This allows you to use the honeypot field’s custom property to identify profiles submitted by a bot with segmentation in Klaviyo:

For instructions on how to create a honeypot field, we recommend reading the following resource:

• How to create a simple honeypot to protect your forms from spammers

What to do if you experience list bombing

If you experience list bombing, create a segment using the patterns you identified in the attack, such as the entry point, submission timeframe, shared email domain, or a honeypot property. Review the profiles in the segment before suppressing them so you do not exclude legitimate subscribers.

The following example identifies email profiles that have received messages but never opened or clicked an email or placed an order. Use it as a starting point for review, not as proof that the profiles were submitted by bots:

• If someone can or cannot receive marketing > Person can receive email marketing
  AND
• What someone has done (or not done) > Person has Received Email is at least 3 in the last 180 days
  AND
• What someone has done (or not done) > Person has Opened Email 0 times over all time
  AND
• What someone has done (or not done) > Person has Clicked Email 0 times over all time
  AND
• What someone has done (or not done) > Person has Placed Order 0 times over all time

This example can include legitimate subscribers who have never engaged. It also excludes profiles that have received fewer than 3 emails in the last 180 days. Use AND to combine the example with conditions tied to your attack, such as a shared email domain or a honeypot property. Do not send additional emails just to make new profiles meet this example.

After reviewing the segment, suppress the profiles to stop them from receiving marketing emails. Suppressed profiles remain in your account; email suppression does not stop SMS messages or push notifications.

Review the opt-in settings on your affected lists and enable double opt-in if it is turned off. This helps keep unconfirmed subscriptions out of your lists, but does not prevent all malicious form submissions.

Additional resources