List bombing
An attack in which a script submits one victim's address to many signup forms, flooding that inbox with confirmation and welcome emails from legitimate senders.
What it means
M3AAWG describes list bombing as a script filling out hundreds of subscription forms with one address, launching confirmations, notifications and other transactional mail at the victim to overwhelm their account. Each form may be abused only slightly, so a single company rarely sees that it is part of the attack. Spamhaus said in 2016 that webforms accepting subscriptions need protecting because of systemic abuse.
M3AAWG's defences include a CAPTCHA, rate limits per IP, monitoring the same address across forms, hidden fields that only bots fill in, a minimum time to complete the form and renaming common field names. Confirmed opt-in limits the damage to one message per form.
For the sender, an abused form produces complaints and spam trap hits from addresses that never asked.
Related terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes