The email abuse technique called “list bombing” or “email bomb” has been occurring more frequently for the last couple of years.

Any brand which collects email addresses with web forms is vulnerable to list bombing. This type of attack can harm your deliverability and can lead to the following:

• spam complaints
• junk folder placement or a block by mailbox providers
• being completely blocked by email service providers

This article describes how the attack works, why it happens, and what can be done to protect your brand.

List bombing is an automated attack, submitting a legitimate email address multiple times into subscription forms across hundreds or thousands of websites at the same time. It floods the victim’s address with emails, making the mailbox unusable.

The following symptoms can help you to detect an attack:

• An unexpected and significant increase of subscription requests or new subscribers

For example, if you usually have up to 200 new subscribers daily and suddenly there are more than 2000 subscriptions per day, this can be a sign of an attack.

• A sudden change of audience 

For example, if you have a business, based in Germany, and have mostly European mailboxes on your list, but suddenly you start receiving subscription requests from out-of-the-ordinary locations, this might be a cause for suspicion.

• Multiple requests from the same IP

For example, a user that submits numerous requests for different (or the same) mailboxes might be a bot.

• A sharp increase in complaints or bounces 

This is a good indicator that something is going wrong.

There are a few possible reasons for a list bombing attack:

• It is used to divert attention of the victim from important notifications. For example, among thousands of unsolicited emails there could be hidden password recovery attempts, unrequested bank transactions or online purchases, and other important alerts. In such cases, the attack is used as a distraction from a hacking attempt.
• A person can do it for fun, to annoy someone, for revenge, or for other malicious reasons.
• It can also be used to distribute spam. If the web form collects names or surnames, these fields can be filled with spam texts and phishing websites, which will be later used in the personalization of your emails, such as, Double Opt-In (DOI) emails, Welcome emails and even marketing campaigns (in absence of Double Opt-in).

In recent years, ISPs have learned to effectively combat simple attacks, but spam is still evolving.

Sending emails from unknown IPs and random domains does not work anymore. Thus, spammers seek an opportunity to use a legitimate email infrastructure with a well-established reputation.

Malicious scripts scour the web in search of unprotected websites (without CAPTCHA and Double Opt-in solutions) with forms to exploit them. Subscription forms usually trigger transactional emails, which have a better reputation, may bypass suppression and subscription filters. Also, they may be sent with higher priority and have the best deliverability. This means that this type of attack has a higher chance of landing in the inbox. It is always hard to differentiate between a legitimate DOI email and an unsolicited one, meaning that the attack may go on for days from the same source.

In fact, there are three victims of a list-bombing attack:

• The recipient – the affected mailbox becomes unusable or the recipient mail server is overloaded
• The sender – high spam or bounce rates lead to sender reputation damage. It can lead to listings from public blocklists, thus no or hard delivery of emails, or legal complications due to the non-legitimate way of newsletter opt-in (i.e. Contacts ending in your database without their knowledge and should not receive newsletters)
• The email service provider – it can lead to blocklisting of sender IPs or even whole IP ranges, which impacts your ESP’s ability to send emails for other customers as well

Even though the sender is not the initiator of the email bomb, mailbox providers will hold the sender and the email service provider partially responsible for being unable to protect their infrastructure, thus being a participant in the attack. To protect their network and reputation, email service providers may have to take preventative action against accounts being subjected to an attack.

Essential preventative solutions

Optional preventative solutions

Do not panic and start troubleshooting.

1. Identify which web form is abused and the time frame of the attack. List bombing might have been going on in the background for days or even weeks.
2. Take the form offline and implement the described measures.
3. Set the form back online and continue monitoring it.
4. Identify the contacts which were added to your list by bots and remove them or block them.

Here are some simple steps to achieve this:

• Filter for users that were created around the time of the list bombing
• Look for the users with similar names, similar email domains or signed up from same IPs
• When you are able to pinpoint the common denominator, you can start to remove all the users that look similar

List bombing may be damaging to your brand and sender reputation, inbox placement and deliverability of your emails. Fortunately, there are simple steps, which will help to protect your website or stop an ongoing attack. Be prepared and do not let anyone involve you in a cyber-attack!