List bombing: general information

Your newsletter registration process marks the beginning of your relationship with recipients. However, registration forms can be misused by malicious parties for sending spam through so-called list bombing attacks.

List bombing refers to the practice of attacking registration forms by bombarding them with a large number of email addresses simultaneously. To the operator, it may appear like a spike in registrations, but in reality, it is a cyberattack.

Bots are used to register innocent email addresses in bulk via insecure registration forms. These registrations are accepted because the forms lack anti-spam measures and accept all entered email addresses without validation. The addresses may be generated or harvested by bots to harm your recipient list list and your business. Even Double Opt-In (DOI) procedures are insufficient in this case, as the sheer volume of confirmation emails can cause significant disruption.

The first list bombing attack was identified in 2016 by Spamhaus, a well-known anti-spam organization. According to Spamhaus, a single ESP registered over 22,000 signups across 3,000 different customer domains. This led to volumes exceeding 100 email messages per minute to some affected addresses. In one company, nine individual email addresses were registered more than 9,000 times within two weeks, resulting in 81,000 confirmation emails. Dozens of networks, including ESPs, were subsequently listed on the Spamhaus Block List (SBL).

Optimizely continuously monitors its sending infrastructure to inform and advise you about list bombing attacks before they impact your deliverability.

There are several indicators that can help you determine whether your registration forms are being misused for list bombing.

A sudden increase in new registrations, especially if not linked to a marketing campaign, can suggest misuse. Review your data and look for email addresses that repeatedly registered to one or more of your recipient lists within a short period.

A sudden spike or gradual increase in the email volume of signup-related emails can clearly indicate list bombing activity.

Although using a double opt-in method (DOI) protects your recipient list in principle since the signup only becomes effective upon confirmation, the registration form remains vulnerable. This means the risk of complaints and potential reputational damage from emails containing malicious URLs still exists.

Attackers often exploit personalizations in double opt-in messages such as names or other fields to embed harmful links in personalized emails.

If dozens or hundreds of signups originate from a single IP address, it is almost certainly an attack. It makes sense to block the IP address and delete all newly registered addresses associated with it.

Signup-related emails may occasionally bounce due to incorrect email entries. However, persistently high bounce rates suggest that your registration form is being abused.

Depending on your company’s geographic focus, you typically send more emails to certain ISPs than others. A high number of opt-in emails or bounces from ISPs uncommon in your region may indicate abuse.

Example: If your business mainly operates in the DACH region, a high volume of double opt-in messages to Russian or Chinese mailbox providers — or even global ISPs like AOL or Yahoo — is unlikely and may signal misuse.

If you receive spam complaints related to your opt-in emails, review recent registrations. Your forms may be under attack.

When your forms are targeted by list bombing, your data becomes corrupted. Not only invalid but also valid addresses may be fraudulently added to your list, negatively impacting your sender reputation and deliverability.

As described in the Sender Reputation Guide, ISPs collect data about each sender's mailing activity and use it to determine how to treat your emails. Key metrics analyzed include:

Misuse of registration forms can lead to unexpectedly high email volumes. Sending to large numbers of inactive users causes high hard bounce rates. Registering spam trap addresses can result in being listed on public or ISP-internal blocklists, and in the worst case, all your emails may be blocked. Additionally, sending to valid addresses registered by a spammer may result in angry recipients, low engagement, and spam complaints.

All these factors harm your sender reputation. Preventive measures against list bombing are essential for every registration form.