Most denial of service attacks are discussed in terms of websites, servers, and networks. Send enough traffic to a system, and legitimate users can no longer reach it. Email, SMS, and call flooding apply a similar idea to a person.
The linked article presents a first person account of being targeted across all three communication channels. Instead of overwhelming a server, the attacker overwhelms the victim with messages and calls. The phone keeps ringing, notifications arrive faster than they can be reviewed, and the inbox becomes almost unusable.
What interested me most is that the attack does not necessarily need to compromise an account or install malware. It can still disrupt someone’s ability to communicate, notice important alerts, and make calm decisions. In that sense, attention itself becomes the attack surface.
More than an annoying spam campaign
A few unsolicited messages are easy to dismiss. A coordinated flood is different because it creates an immediate operational problem.
Email bombing can fill an inbox with newsletters, registration confirmations, password reset messages, and other automated mail. SMS flooding can make it difficult to find legitimate verification codes or messages from banks and service providers. Repeated calls add another layer of pressure by interrupting work, sleep, and normal phone use.
The individual messages may not be sophisticated. The effectiveness comes from volume and timing.
This is why I would treat a sudden flood as a potential security incident rather than only a spam problem. The noise may be the entire objective, especially in a harassment campaign. It can also serve as cover for something more serious.
For example, an attacker who has accessed a shopping, banking, or online service account might generate hundreds of unrelated emails to bury a real purchase confirmation or security warning. The victim sees a wall of junk and may delete everything without noticing the one message that matters.
The same principle applies to text messages. A legitimate one time code, password reset notification, or mobile carrier alert can disappear among hundreds of unwanted messages.
Flooding attacks exploit human limits
Computers are good at filtering large amounts of data. People are not.
When notifications arrive continuously, it becomes harder to separate useful information from noise. The victim may start deleting messages in bulk, silencing all calls, or clicking links quickly just to stop the flood. Those reactions are understandable, but they can create additional risks.
This is partly a social engineering problem. The attacker is manipulating the victim’s environment rather than relying only on a convincing phishing message. Stress, confusion, and notification fatigue can make even a technically experienced person miss warning signs.
It also shows why cybersecurity cannot be reduced to strong passwords and antivirus software. Availability matters too. An email account might remain technically secure while becoming temporarily useless. A phone number might still work, but the owner may be unable to distinguish real calls from automated harassment.
A message flood does not automatically mean account compromise
It is important not to jump to conclusions. Receiving thousands of emails or calls does not, by itself, prove that an attacker has obtained a password or entered an account.
However, it is a reason to investigate.
I would begin by looking for security alerts, payment confirmations, password changes, new login notifications, and messages from mobile carriers or financial institutions. Searching by sender or service name is usually more effective than trying to read every message in chronological order.
Other useful checks include:
- Reviewing recent account login activity
- Checking bank and payment service transactions
- Looking for unfamiliar purchases or password resets
- Confirming that account recovery details have not changed
- Checking whether a mobile number has been transferred or modified
- Reviewing email forwarding rules and filters for unauthorized changes
- Inspecting active sessions and signing out unknown devices
If there is evidence of unauthorized access, passwords should be changed from a trusted device. Important accounts should use unique passwords and multifactor authentication. An authenticator application or a hardware security key is generally more resistant to phone number attacks than SMS based verification.
The mobile carrier account should also have a separate PIN or passcode where possible. That can help reduce the risk of unauthorized number transfers and related account recovery attacks.
Do not interact with the flood blindly
One dangerous reaction is clicking every unsubscribe link. In a normal newsletter, unsubscribing may be reasonable. During a malicious flood, some messages may contain phishing links, while others may use unsubscribe requests to confirm that an address is active.
It is safer to use the email provider’s built in spam controls and filters. Suspicious messages should not be opened unnecessarily, and attachments should be treated carefully.
Blocking individual phone numbers may provide temporary relief, but it is not always a complete solution. Automated systems can rotate numbers, and caller ID information can be spoofed. Carrier level spam protection and call screening features may be more useful than manually blocking hundreds of callers.
Preserving evidence is also important. Screenshots, timestamps, call logs, message headers, and examples of the content can help service providers or investigators understand what happened. Before deleting everything, it is worth saving a representative sample.
If the messages contain threats, personal information, extortion attempts, or signs of immediate danger, the incident should be reported to the appropriate platform, mobile carrier, and local authorities.
The source itself deserves critical reading
There is another detail worth considering. The post is published under a profile associated with the FloodCRM name. That does not automatically make the account inaccurate, but it does mean the source should be read with the same caution applied to any interested party.
A personal story is useful for understanding what an incident feels like, but it is not the same as an independent technical investigation. Claims about attack capabilities, scale, attribution, or effectiveness should ideally be supported by logs, provider records, or reporting from independent security researchers.
This is a useful habit for anyone studying IT. Technical content should be evaluated not only by what it says, but also by who published it, what evidence is provided, and whether the publisher has a commercial or reputational interest in the subject.
Why this type of attack matters
Email, SMS, and call flooding sit at the intersection of cybersecurity, abuse prevention, privacy, and telecommunications. They use legitimate infrastructure in an abusive way, which makes them difficult to stop without also affecting normal users.
A registration form, newsletter system, verification service, or automated calling platform may work exactly as designed. The abuse appears when someone triggers those systems repeatedly or coordinates many of them against one target.
Service operators can reduce this risk with rate limits, bot detection, confirmation controls, abuse monitoring, and restrictions on repeated requests to the same destination. These protections need to be designed carefully. Weak controls make abuse easy, while overly aggressive controls can block legitimate customers.
For individuals, the main lesson is simple: a sudden communication flood should not be viewed only as clutter. It may be an attempt to disrupt, intimidate, or conceal another action. The best response is to slow down, preserve evidence, examine critical accounts, and avoid reacting impulsively to the noise.
The attack may target an inbox or phone number, but its real objective is often the person trying to make sense of it all.
Original source: https://medium.com/@floodcrmorg/what-happened-when-i-was-targeted-by-floodcrm-email-sms-and-call-flooding-51ba103d98c4