Definition
List bombing is a form of email abuse where an attacker uses an automated script to submit a victim's email address to a large number of mailing list sign-up forms. The victim receives hundreds or thousands of confirmation or welcome emails, overwhelming their inbox and potentially causing them to miss important legitimate messages.
List bombing can also damage the sender's reputation indirectly — the victim may mark all the unwanted emails as spam, generating complaint rates that trigger mailbox provider scrutiny. List bombing is often used as a harassment tactic or as a smokescreen to distract the victim from other malicious activity.
List Bombing Characteristics
| Indicator | Description |
|---|---|
| Sudden volume spike | Dozens to hundreds of sign-ups for the same email |
| Geographic diversity | Sign-ups originate from diverse IP addresses |
| Stolen or spoofed identity | The attacker uses the victim's email without their knowledge |
| Multiple list types | Sign-ups across unrelated mailing lists |
| Timestamp clustering | All sign-ups occur within a short time window |
Prevention and Mitigation
- Use CAPTCHA or honeypot fields on all sign-up forms
- Implement rate limiting on form submission per IP address
- Send a confirmation email (double opt-in) before adding to your active list
- Monitor for rapid sign-up spikes and investigate unusual patterns
- Provide a mechanism for recipients to report unwanted sign-ups
- Implement list bombing detection that pauses automated verifications during attacks
Related Glossary Terms
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
DMARC (Domain-based Message Authentication)
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM to prevent domain spoofing and provide reporting on authentication failures.
Email Authentication
Email authentication (SPF, DKIM, DMARC) is a set of technical protocols that verify an email is genuinely from the domain it claims to be sent from. It prevents spoofing, phishing, and improves deliverability.
Email Content Blocking
Email content blocking by ISPs including Gmail clipping, image blocking, link wrapping, attachment blocking, and script restrictions.
Fraud Protection
Email fraud protection detects and prevents fraudulent activities targeting your email programme, including phishing, spoofing, account takeover, and fake signups.
Email Password Reset
Security-critical transactional emails that enable verified account access recovery, balancing strict authentication requirements with user-friendly design and deliverability.
Frequently Asked Questions
Use double opt-in so the recipient must confirm their subscription before being added. Implement rate limiting on your sign-up forms. Use CAPTCHA or honeypot fields. Monitor sign-up patterns for spikes. These measures protect both your list quality and potential victims from being bombed via your forms.
Immediately pause any automated sign-up confirmations until you can verify the pattern. Investigate the affected sign-up entries and remove fraudulent subscriptions. Reach out to the affected recipient if possible. Review your sign-up security measures and implement additional protections before re-enabling auto-confirmations.