Bot Signups in Email Marketing

🚨 We got hit with over 25,000 fake user signups. In just over an hour. Last week, mentor.sh experienced a massive wave of bot-driven fake registrations. Turkish-language spam, phishing URLs in usernames, disposable emails - the works. It wasn’t fun. But it was a wake-up call. What happened: - 25k+ fake accounts created in a short burst - Most used throwaway emails like "mail7 . io" - Many had phishing links in names, likely for SEO or abuse - Our signup route was public, and bots found it What saved us (surprisingly): We had just hit our Mailtrap email quota — so no spam emails were actually delivered. A surprising fail-safe. What we did: - Purged 24k+ accounts - Added Cloudflare Turnstile CAPTCHA - Blocked disposable domains - Rate-limited suspicious traffic - Upgraded email infra & alerting What we’re doing now: - Hardening all auth routes - Monitoring spikes in real time - Adding anomaly detection - Introducing friction for suspicious signups Lesson: bots don’t care how big your platform is — just that you have a form exposed. If you’re building something — protect it from day one. Read the full postmortem here → https://lnkd.in/dTS78ZSE

One client refused to add double opt-in. They were convinced it would “kill list growth.” At first, the numbers looked great. Signups kept coming in. But most weren’t real people. Their forms were full of bots and fake emails. Soon Spamhaus flagged them. Then Microsoft blocked every campaign. We flipped the script: ✅ Added double opt-in ✅ Protected forms with reCAPTCHA and hidden honeypots ✅ Cleaned the list to remove the damage Growth slowed slightly, yes. But revenue per send went up. And the best part? Their reputation recovered, so campaigns started landing in the inbox again. The lesson was clear: Quality always beats quantity.

I just helped a client clean 20,000+ bots from their email list. (Over 1/3 of their list size). Here's how you can remove them from yours too: 1) Plug the hole. Find out where the bots are coming from. Map out all the different channels a bot can join your email list. 👉 Website 👉 Signup Forms 👉 Typeform 👉 B2B/Distributor Channels 👉 Social Media Based on what I've seen, most bots will come through your store by making an account. 👉 If you're on Shopify, you can activate reCAPTCHA on your store. Others sometimes join from a popup or form. 👉 You can set up a Honeypot on your popups and forms. 2) Find the bots. Most bot accounts will follow a similar pattern: 👉 Email address contains + 👉 First and last name contains a number or character 👉 Source = -50 👉 Often don't have a phone number You can make a segment of these profile properties in Klaviyo to exclude. Other bot accounts might be more difficult to scrape: 👉 Identical profiles with the same name and info 👉 First and last names have random letters You'll have to manually go through and delete these. 3) Delete. These bots aren't worth including in your suppressed list. You're better off deleting them from Klaviyo entirely. Removing these bots from your list can help: ✅ Reduce spam rates ✅ Increase deliverability ✅ Boost engagement Try and see how many you can remove from your list.

This week in fraud: 724 fake accounts in 2 hours 🤖. This customer is an email platform for AI agents. Anyone can sign up, give their agent an inbox. They even offer 1,000 free emails a month! No credit card required. These attackers signed up and started sending spam emails. Emails about a fake declined payment which requires you to enter your credit card details to verify. Once you verify, the card details are stolen (it's all fake). These attackers were not sophisticated. They were using an AI generated code. But 724 accounts, each with 1,000 free emails, that's 724K potential victims! Needless to say Rupt stopped them! But if you don't have a protection system for your onboarding, here are a few things you should do immediately to avoid this kind of attack: 1. Rate limit signups based on IP (and be more aggressive as abuse continues) 2. Check for a valid user agent! Don't allow headless signups if you don't support it. If you want a stronger stance: 3. Check the browser fingerprint and rate limit based on that too. 4. If multiple sign ups from the same fingerprint/ip, require a phone number 5. Require 2FA for each sign up method 6. Detect and disable disposable emails and phone numbers and non-supported geographies 7. Detect lies (UA lies, bot lies, timezone mismatch lies, etc.) and if they add up, stop/flag the sign up. You can and should do more as you grow and as the risks for your business grows.

"Mmmm mm, that's a nice looking form you have there. Is that...a field for an email address? Wow, impressive! 😍" -Direct Quote from Bots (edited for general audiences because those things say some downright nasty stuff!) To be clear, when we talk about "bots" filling out forms or clicking emails, these are not humanoid, Johnny 5 or Wall-e types sitting around checking out the internet and disrupting your email marketing KPIs. They're just...software. Programmed to imitate human behavior, automatically, typically the ones filling out the forms and the ones doing all the clicking are on opposite ends of the security spectrum; the signup bots the bad guys, and the clicky ones the heroes. Anyone from angry amateur to seasoned hacker could theoretically find fulfillment, personal or professional, in abusing vulnerable signup forms, whether merely to see if they could do it, or as part of a larger operation. During what is often referred to as "list bombing" or simply, a "signup form attack", bad actors will inundate signup forms with a flood of email addresses. Forms that allow additional text-based input, like a name, can be weaponized too, especially if the field isn't restricted to just alphanumeric characters. For example, savvy scumbags could submit a link to a malicious or offensive website in that field, meaning that when you eventually send a personalized message it will say "Hey [link to bad website]!" rather than, "Hey [firstname]!". Both senders and receivers ultimately suffer as recipients' inboxes fill up with unwanted (and potentially dangerous) mail, and senders are left with the reputational fallout from poor engagement and increased complaints. If you have any online form, even if it's just a "contact us" in your website footer, ALWAYS make sure it's secured! There are a few standard options, including a captcha (or similar solution), and a honeypot field. 🏍️ While captcha is fairly effective on its own, some can be bypassed, and the classic "click all the motorcycles" version makes us all question our own humanity (in addition to adding unwanted friction during signup). 🍯 A honeypot is an invisible field on your signup form. Since real people can't see the honeypot field, they won't fill it out. A bot, on the other hand, will submit a value for every field it finds, even the delectable little honeypot. You can safely discard any submission with an entry in the honeypot field because there wasn't a legitimately-interested human being providing the address. Of course, bots aren't the only threat to your mailing list! It wouldn't be an Alison Gootee post if I didn't remind you to ask for permission (don't just take it), perform double opt-in, and send content that benefits subscribers more than it does your bottom line. 💝 #deliverability #security

I got an email earlier this month from an old client: "Our revenue is dropping, but opens and clicks look fine." That must mean their copy isn't aligning, and subscribers aren't interested, right? Well, not necessarily... For DTC brands that rely on consistent email revenue, the first drop you will notice is actually revenue. It's a sudden drop. It used to be that you were able to use opens and clicks to see a downward trend before it hits revenue, but the rise of bots, opens and clicks are becoming less reliable. So what exactly happened with this client's account? AI-powered bots. If you are using any AI-powered software tools to "improve" your email segmentations or scrape data from your website to "enhance" your subscribers' profile know this: You are opening a giant portal for bots to enter your lists. So what do you need to do? 👉🏻 Watch your bounces - If you are seeing high bounces on the first emails in your flows, check your traffic. 👉🏻 Check your email campaign traffic - Your overall KPIs may look normal but when you break it down by MBPs or countries it can tell a whole other story. In this client's case, he was getting high bounce rates from another country that he didn't even sell in. When looking at the bots profiles, they all came from an AI-powered tool he had installed to help with "better" segmentations. He's losing around 20% of his email revenue at this point even though his opens and clicks look "normal." 👉🏻 Use AND segmentations - it's not "subscriber can receive email marketing" OR "opened or clicked (x amount of) emails in (x amount of days). It's "subscriber can receive email marketing" AND "opened or clicked (x amount of) emails in (x amount of days). This is one high-level segmentation condition. You need to apply layers of AND conditions for accurate segmentation. I get that AI is all the rage right now, and we all want to be efficient, but it shouldn't come at the expense of your email deliverability. Using a tool that was doing more damage than good caused him his domain reputation to take a hit. Luckily, we are fixing fast and he'll be able to recover his lost revenue. Tomorrow in my newsletter, I will be talking about better email segmentations and how to approach your list. Sign up and don't miss it. Need an email deliverability audit? DM me or book a call.

Shopify Email just got smarter. Bots are now automatically filtered out from your email sends. Here’s what’s new: ✅ Shopify Email now identifies bot-generated subscribers (fake addresses added by automated tools) ✅ These are automatically suppressed at send-out—improving deliverability and reducing cost ✅ They still exist in your Customers list, but emails won’t be sent to them No config needed. No extra tools. Just a cleaner list—and better performance. Why this matters: • Better inbox placement • Higher open and click rates • Lower risk of getting flagged as spam • Lower cost per campaign (Shopify Email charges per send) It’s a small but meaningful step toward more reliable email marketing for Shopify merchants. Have you noticed cleaner stats already? Let’s talk. 👇

Half of your "most engaged" email subscribers don't actually exist. They appear in your metrics as your best subscribers... >> Consistent opens >> Frequent clicks But they're just bots, automatic openers, and non-human interactions. And they're completely distorting your email marketing reality. Here's what's really happening: >> iOS/Apple Mail users show as "opens" regardless of actual engagement >> B2B security tools automatically click your links to scan for threats >> Your "highly engaged" segments are heavily contaminated with fake activity >> Your re-engagement campaigns are targeting people who never saw your emails And... you're making critical business decisions based on these phantom metrics. Imagine having crystal-clear visibility into who's actually engaging with your emails. Picture making decisions based on real human behavior instead of bot activity. Think about how much more effective your email marketing would be if you could separate the signal from the noise. Here's a simple test to identify bot clicks: 1) Create an invisible link in your email footer by bolding and underlinking a period or number that no human would notice. 2) Tag anyone who clicks it as "probable bot engagement" and remove them from your "highly engaged" segments. 3) Then, start rebuilding your email strategy based on genuine human connection, not algorithmic ghosts. This is just ONE of the things Lyndsay Phillips - Podcast Leverage/Repurposing🎙️ and I chatted about on our recent podcast. Listen here: https://lnkd.in/gWTJCMHD

I remember the first time a spambot attacked one of the sign-up pages at BuzzFeed. At first, we didn’t realize what was happening. We were looking at our email lists and saw that a ton of new subscribers were signing up for our newsletters that day — exciting! But then we looked a little closer. Almost all of the subscribers were from the same domain, yahoo.co.uk, which seemed odd. And then we looked even closer: The sign-ups were coming in so quickly — dozens of new yahoo.co.uk emails every minute — there was no way the email addresses were submitted by actual humans. That’s when we realized that something was seriously wrong. But we didn’t realize how much trouble we were in. We were the victims of a spambot, which had been crawling the web looking for a form like ours. These bots are usually looking for forums with a comment section where they can drop in a link to a page where someone can buy something, like pharmaceutical drugs. These bots don’t always realize that they’ve found a newsletter sign-up form — not a comment section. And if lots of bots end up on your list, it can cause serious deliverability issues. So what can you do about them? 1.) You can use a third-party tool to verify email addresses, like Kickbox, before adding them to your list. 2) You can use CAPTCHA, like we eventually did at BuzzFeed, to shut down bot activity on key forms. 3) You can set up a honeypot — a hidden field only a bot can see, and suppress any email address that fills out that field. 4) You can use double opt-in to require an extra confirmation before being added to the list. Your strategy might even involve multiple steps — many teams use CAPTCHA and double opt-in, for instance. Every newsletter should have a game plan for keeping their list clean. I’ve got more ideas here (https://lnkd.in/g89f2553) about how to build out the right strategy for your newsletter. ––– 📷 Below is a screenshot of the BuzzFeed newsletter page. There’s the CAPTCHA logo in the bottom right corner — three overlapping arrows of different colors — that indicates that the form is being secured by CAPTCHA.

🤔 Ok, imagine you are a Saas platform (think like ChatGPT or Canva) that are following best practices but you're still getting a lot of spammy or junk signups from free user profiles that are tanking your email reputation. How do you continue to market every potential lead while protecting your deliverability? You build a qualifying automation. Below is a simplified example of what I've helped build before that I like to call "The Gauntlet" (great Clint Eastwood movie, btw). In this example, the automation goes through a series of qualifier rounds to see if a contact is likely worth marketing to: - Round one: Obvious strong marketing potential (think business accounts, paid users, etc.) - Round two: Possibly interested marketing potential (think free users who fill out more user data or come from less spammy sources) - Round three: Possibly active marketing potential (think free users who are hyper active and utilizing features associated primarily with high-interest users) Those who pass round one go right to regular marketing efforts but those who don't pass until rounds two or three are forced through another qualifier of confirming interest with an action on the welcome email. Those who don't pass anything or fail confirmation are suppressed. This is why a flexible, tracking-enabled, CDP-based automation software is important for your email efforts, specifically for protecting deliverability and creating a more personalized experience rather than a market-to-all approach.