Impacted by spam bot attacks

Welcome to the community!

If you are seeing these profiles sharing the same domain on the email address, you could use mail ward from the app marketplace to block that domain entering your Klaviyo flows and it is free, so that might be worth a try otherwise if you enable double opt in that should hopefully stop them from entering your lists

Hope that gets resolved for you!

We are seeing a similar issue, was this the fix?

Somewhat, there is a limit on the domain blocking for free. I do appreciate the help!

Glad that worked for you, you can pair it with flow filter conditions but it wouldn’t auto suppress. You could use Klaviyo’s API in a custom solution for that instead though!

Hi Anna, we see this a lot in our projects. The key shift is blocking bots before they become profiles, because once they are in, they count towards billing and hurt deliverability.

A few things that work in practice:

Double opt-in is the single biggest lever. Bots almost never confirm, so they stay as inactive profiles you can suppress in bulk instead of active ones you pay for.

Second, validate at the form level. A honeypot field (hidden field that humans never fill, bots do) catches a lot. If you built a custom form, an email validation check before the subscribe call fires stops fake and mistyped addresses from ever reaching Klaviyo.

And set up a small routine: a segment for suspicious patterns (gibberish names, random letter combos, spikes of signups from one domain) that you review and suppress monthly. Suppressed profiles don't count towards your active count, so this keeps billing clean even when something slips through.

The domain blocking you set up is a good extra layer, but double opt-in plus form validation is what actually stops the inflow.