Post

Had to turn on CAPTCHA on a site I've barely marketed. In 2 weeks, bots fed 203 scraped emails into my forms. Each one got a confirmation from cabin.watch - 203 strangers who never asked for anything. One gov address, three times. If your form sends email, it's a spam cannon until proven otherwise

A layer that pairs well with the captcha: cap confirmation emails per address and per IP over 24 hours, so a replayed address gets one email at most. Scraped lists also carry a lot of role addresses like info@ and admin@, which you can hold back before anything is sent.