What are the purposes of bots signing up for emails and accounts on websites?

Summary

Bots sign up for email and website accounts for a wide variety of malicious purposes, ranging from basic spam and phishing to more sophisticated attacks. Key motivations include collecting email addresses, spreading malware, conducting fraud, testing vulnerabilities, launching DDoS attacks, scraping data, skewing online polls, performing credential stuffing, hiding malicious activity via mail-bombing, artificially inflating site statistics, and even for the simple reason of causing disruption. Experts agree that multiple factors can be at play simultaneously, and securing forms is crucial to mitigating these threats.

Key findings

  • Data Harvesting: Bots collect email addresses for spam lists, phishing campaigns, and resale.
  • Malware Distribution: Bots spread malware through links posted in comments, forum posts or emails.
  • Fraud and Manipulation: Bots conduct fraud, skew online polls, perform credential stuffing and other illicit activities.
  • Vulnerability Testing: Bots test forms for vulnerabilities like XSS and SQL injection, as well as searching for websites running outdated or insecure plugins and configurations.
  • Denial of Service: Bots launch denial-of-service attacks to overwhelm websites with traffic and disrupt services.
  • Concealment: Mass sign-ups (mail-bombing) can be used to hide other fraudulent activities, such as bypassing 2FA or cashing out credit card points.

Key considerations

  • Form Security: Implement robust security measures to protect web forms from bot sign-ups.
  • Bot Detection and Mitigation: Utilize bot detection and mitigation techniques to identify and block malicious bot traffic.
  • Vulnerability Scanning: Regularly scan for and patch vulnerabilities in plugins, software, and configurations.
  • Rate Limiting and Monitoring: Implement rate limiting and monitor sign-up activity to identify and mitigate bot attacks.
  • Holistic Approach: Adopt a holistic security approach, recognizing that bot sign-ups can serve multiple purposes and require comprehensive defenses.

What email marketers say
11Marketer opinions

Bots sign up for emails and accounts on websites for a variety of malicious purposes. These include spamming, phishing, spreading malware, harvesting email addresses, testing for vulnerabilities, inflating site statistics, performing mail-bombing attacks to hide other malicious activity, and even just causing chaos. Securing forms is critical to prevent these activities.

Key opinions

  • Spam and Phishing: Bots are frequently used for mass spam campaigns and phishing attempts, leveraging harvested email addresses or posting malicious links.
  • Vulnerability Testing: Bots probe forms for vulnerabilities, such as XSS or SQL injection, and can identify websites with insecure plugins.
  • Data Harvesting: Bots collect email addresses for creating spam lists or selling to other spammers.
  • Mail-bombing: Bots initiate a high volume of sign-ups to hide other malicious activities, such as fraudulent transactions.
  • SEO and Manipulation: Bots can artificially inflate site statistics and traffic, and they can be used for search engine optimisation and SEO purposes

Key considerations

  • Form Security: It is critical to secure web forms to prevent bot sign-ups and the subsequent malicious activities.
  • Monitoring: Monitoring sign-up activity can help identify and mitigate bot attacks.
  • Email Deliverability Testing: Bots can be used to test the deliverability of emails, so it is important to monitor deliverability rates and address any issues.
  • Sociopathic Intent: Some bot activity is driven by individuals with malicious intent, making it essential to implement robust security measures.
Marketer view

Email marketer from Quora answers that spam bots are used to collect email addresses, promote products or services, spread malware, and for phishing attempts.

April 2023 - Quora
Marketer view

Email marketer from StackOverflow answers that one of the common reasons for spambots is to post malicious links, which are dangerous for visitors.

October 2023 - StackOverflow
Marketer view

Email marketer from Reddit shares that spam bots sign up to websites to test email deliverability, to check for data breaches, and to create email lists for future attacks.

November 2021 - Reddit
Marketer view

Email marketer from Reddit explains that bot accounts can be used to test the resilience of a website, for search engine optimization (SEO), and to cause havoc on the internet.

November 2024 - Reddit
Marketer view

Email marketer from Email Geeks suggests bots may be attempting to fill inboxes with legitimate mail while acting as a canary.

August 2022 - Email Geeks
Marketer view

Email marketer from Blackhatworld shares that email spam bots are used for mass spamming, phishing, selling harvested data, and/or using the accounts later for other reasons.

December 2022 - Blackhatworld
Marketer view

Email marketer from Email Geeks shares an anecdote where someone they know had their credit card points stolen due to email-bombing.

February 2025 - Email Geeks
Marketer view

Email marketer from Email Geeks explains they tell customers that securing their forms is about mail-bombing to hide connection notifications but also suggests "some people are just sociopaths".

December 2022 - Email Geeks
Marketer view

Email marketer from StackExchange explains that the bots can be used to populate forums with spam content and links, used to artificially inflate site statistics, such as page views and traffic or for phishing purposes.

January 2022 - StackExchange
Marketer view

Email marketer from Spiceworks shares that spam bots collect email addresses to create lists for mass spam campaigns, for phishing, or to sell those lists to other spammers.

August 2024 - Spiceworks
Marketer view

Email marketer from SitePoint explains that the purpose of bot sign ups can be to post spam comments or links, but also to test forms for vulnerabilities.

November 2023 - SitePoint

What the experts say
4Expert opinions

Experts suggest that bots sign up for emails and accounts on websites for a multitude of reasons, including comment spam, mailbombing to conceal other activities (like hiding 2FA emails), exploitation of vulnerable websites, and even random acts of disruption. Often, it's a combination of factors at play.

Key opinions

  • Multi-Purpose: Bot sign-ups are rarely for a single reason; multiple motivations are often involved.
  • Exploitation: Bots identify and exploit websites with default, insecure, or outdated plugins and test for vulnerabilities like XSS or SQL injection.
  • Concealment: Mailbombing through mass sign-ups can be used to hide more serious fraudulent activities, such as bypassing 2FA.
  • Simple Spam: Bots may simply be programmed to fill any available form field, leading to comment spam.

Key considerations

  • Holistic Security: Websites need comprehensive security measures to address the various reasons for bot sign-ups, not just focusing on one potential threat.
  • Vulnerability Scanning: Regularly scan for and patch vulnerabilities in plugins, software, and configurations to minimize exploitation risks.
  • Rate Limiting: Implement rate limiting and other anti-abuse measures on forms to mitigate mailbombing and spam attempts.
Expert view

Expert from Email Geeks explains that bot sign-ups can help bad actors find websites with default, insecure, or outdated plugins, and also test for XSS or SQL injection vulnerabilities.

March 2024 - Email Geeks
Expert view

Expert from Word to the Wise explains that comment spam bots are primarily filling out forms because they see an available box to input information.

September 2022 - Word to the Wise
Expert view

Expert from Email Geeks shares research indicating that bot sign-ups are often comment spam, mailbombing attempts to hide 2FA emails, or just random acts of sociopathy.

April 2021 - Email Geeks
Expert view

Expert from Email Geeks states that it doesn't have to be one reason, but could be all of the reasons and more.

April 2023 - Email Geeks

What the documentation says
4Technical articles

Documentation from various sources indicates that bots sign up for emails and accounts on websites for a wide array of malicious purposes. These include spamming, spreading malware, conducting fraud, credential stuffing attacks, launching denial-of-service attacks, web scraping, data harvesting, and skewing online polls. The goal is often to generate accounts on a massive scale for distributing unsolicited messages and harvesting valid addresses for building mailing lists.

Key findings

  • Credential Stuffing: Bots perform credential stuffing attacks and account takeovers, using compromised credentials to gain unauthorized access.
  • Malicious Activities: Bots engage in various harmful activities such as spamming, spreading malware, and skewing online polls.
  • Data Harvesting: Bots are used for web scraping and data harvesting, collecting information from websites for various purposes.
  • Fraudulent Transactions: Bots can be used for transaction fraud, creating fake accounts for illicit financial gain.
  • Denial of Service: Bots launch denial-of-service attacks, overwhelming websites with traffic to disrupt services.

Key considerations

  • Account Security: Implement robust account security measures to prevent credential stuffing and account takeovers.
  • Bot Detection: Utilize bot detection and mitigation techniques to identify and block malicious bot traffic.
  • Web Scraping Protection: Protect websites from web scraping and data harvesting by implementing anti-scraping measures.
  • Transaction Monitoring: Monitor transactions for fraudulent activity and implement safeguards to prevent financial losses.
  • Traffic Management: Employ traffic management solutions to mitigate denial-of-service attacks and ensure website availability.
Technical article

Documentation from Microsoft shares that spammers automatically generate accounts on a massive scale and use them to distribute unsolicited messages. They also harvest valid addresses to build mailing lists.

July 2022 - Microsoft
Technical article

Documentation from Cloudflare explains that bots sign up for accounts to perform credential stuffing attacks, account takeovers, spamming, and launching denial-of-service attacks.

December 2022 - Cloudflare
Technical article

Documentation from Imperva explains that bad bots are used for web scraping, data harvesting, competitive data mining, denial of service, transaction fraud, and spamming. They can also be used for account creation fraud, comment spam and other malicious activities.

June 2024 - Imperva
Technical article

Documentation from OWASP (Open Web Application Security Project) explains that bots create fake accounts for various malicious purposes, including spamming, spreading malware, skewing online polls, and conducting fraud. They also perform web scraping.

March 2024 - OWASP