Definition
List bombing is a form of email abuse where an attacker uses an automated script to submit a victim's email address to a large number of mailing list sign-up forms. The victim receives hundreds or thousands of confirmation or welcome emails, overwhelming their inbox and potentially causing them to miss important legitimate messages.
List bombing can also damage the sender's reputation indirectly — the victim may mark all the unwanted emails as spam, generating complaint rates that trigger mailbox provider scrutiny. List bombing is often used as a harassment tactic or as a smokescreen to distract the victim from other malicious activity.
List Bombing Characteristics
| Indicator | Description |
|---|---|
| Sudden volume spike | Dozens to hundreds of sign-ups for the same email |
| Geographic diversity | Sign-ups originate from diverse IP addresses |
| Stolen or spoofed identity | The attacker uses the victim's email without their knowledge |
| Multiple list types | Sign-ups across unrelated mailing lists |
| Timestamp clustering | All sign-ups occur within a short time window |
Prevention and Mitigation
- Use CAPTCHA or honeypot fields on all sign-up forms
- Implement rate limiting on form submission per IP address
- Send a confirmation email (double opt-in) before adding to your active list
- Monitor for rapid sign-up spikes and investigate unusual patterns
- Provide a mechanism for recipients to report unwanted sign-ups
- Implement list bombing detection that pauses automated verifications during attacks
Was this useful?
Related Glossary Terms
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
DMARC (Domain-based Message Authentication)
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM to prevent domain spoofing and provide reporting on authentication failures.
Email Account Takeover
Email account takeover is when an attacker gains unauthorised access to a sender or subscriber email account, often to steal data or send spam, damaging trust and reputation.
AI Spam Filter
An AI spam filter uses machine learning to detect spam, phishing, and junk mail, evolving beyond static keyword rules.
Frequently Asked Questions
Use double opt-in so the recipient must confirm their subscription before being added. Implement rate limiting on your sign-up forms. Use CAPTCHA or honeypot fields. Monitor sign-up patterns for spikes. These measures protect both your list quality and potential victims from being bombed via your forms.
Immediately pause any automated sign-up confirmations until you can verify the pattern. Investigate the affected sign-up entries and remove fraudulent subscriptions. Reach out to the affected recipient if possible. Review your sign-up security measures and implement additional protections before re-enabling auto-confirmations.