Greetings Flufferschnoots ~ I’ve temporarily disabled new signups because I’ve noticed a suspicious pattern of new accounts that appear to be linked to malicious bot activity.
The sketchy signups have been coming from a variety of corporate, government, and institutional email addresses. I looked into it and this appears to be a sign that my newsletter signups form is used as part of an "email bombing" attack where a target inbox is flooded with noisy emails to bury important notifications (such as failed login attempts, 2fa, etc.)
For my tech-adjacent Flufferschnoots, I thought this was worth sharing as I was unaware that an ordinary signup form could be weaponized this way. The malicious actors use an endpoint to automate newsletter subscriptions (likely from a list of potentially compromised accounts). Unfortunately, its also a bit embarrassing because I've been blasting my furry asmr out to random people that never asked for it. It also increases my email bounce rates which affect my domain's sending reputation.
Hackers and malicious actors suck ass but one of the best medicines is knowledge: now you are aware of this attack vector. I'm still working on a way to solve it without making new signups more difficult and I'll report back when I do. 💙
