Email Subscription Bomb - Automated Signups Flooding Inbox

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects an 'Email Subscription Bomb' attack, where an attacker automates sign-ups to various services using a victim's email address. The goal is to flood the victim's inbox with confirmation emails, potentially causing a denial of service or distracting them from other malicious activities. The rule specifically looks for SMTP traffic to port 25 containing the phrase 'confirm your subscription' (case-insensitive) and triggers an alert if this content is seen 50 times within 60 seconds from the same destination IP address.