What Is a Subscription Bombing Attack?

A subscription bombing attack (also called a list bombing attack or email bomb) occurs when a malicious actor submits a victim's email address to hundreds or thousands of websites, mailing lists, newsletters, and online registration forms in a very short period of time. Each of those services then sends a legitimate confirmation email, welcome message, or newsletter to the victim — resulting in a sudden, overwhelming flood of email to one or more mailboxes.

These attacks are deliberate and targeted. The attacker is not sending spam directly — instead, they weaponize legitimate third-party organizations to do it for them.

Symptoms

You may be experiencing a subscription bombing attack if you notice:

• A sudden, unexplained surge in email volume to one or more mailboxes, often starting within minutes
• Messages arriving from a wide variety of unrelated senders — newsletters, forum confirmations, mailing list welcomes, e-commerce signups, charitable organizations, event notifications, etc.
• Most messages are legitimate in appearance — they come from real organizations and pass spam checks
• The flood started at a specific point in time rather than building gradually
• Only one or a small number of mailboxes are affected, rather than your entire domain
• Messages reference subscriptions or registrations the recipient did not initiate

Why Conventional Spam Filtering Struggles With This

Traditional spam filtering is designed to identify messages from known bad actors, suspicious sending infrastructure, or content with known malicious patterns. Subscription bombing attacks are difficult to filter because:

• The senders are legitimate. The messages come from reputable organizations with good sending reputations, proper SPF/DKIM authentication, and no history of abuse.
• The content varies widely. Because hundreds of different organizations are involved, there are no common subject lines, sender domains, or message patterns to block.
• Broad rules cause collateral damage. Any rule broad enough to catch most of the flood will also block legitimate email the recipient needs.

What You Can Do

1. Check for account compromise first.
Subscription bombing is frequently used as a distraction tactic — to bury legitimate security notifications (password reset emails, fraudulent purchase confirmations, bank alerts) in a flood of noise so the victim doesn't notice their account has been compromised elsewhere. Before anything else, have the affected user carefully review any financial or account-security emails that arrived around the time the attack started.

2. Use TLD blocking for the highest-volume sources.
If the majority of flood messages are coming from specific domain extensions (such as .io, .xyz, or country-code TLDs like .ru or .cn), you can create block rules in the DuoCircle portal under Filtering Rules to reduce volume from those sources. This won't stop everything, but can meaningfully cut the flood if the traffic is concentrated in specific extensions. Be cautious with extensions that may also carry legitimate mail for your organization.

3. Wait it out.
In most cases, the most effective response is patience. These attacks are typically short-lived — the flood subsides within hours to a few days as the attacker's scripts exhaust the available registration forms on the internet. Some newsletter subscriptions may persist afterward (requiring manual unsubscribe), but the acute flood phase ends on its own.

What We Cannot Do

There is no reliable technical solution that stops a subscription bombing attack completely without risking legitimate mail delivery. Because the messages originate from too many unrelated legitimate senders, targeted filtering rules become impractical very quickly. We will not be able to write custom rules that catch the full attack without collateral damage to normal mail flow.

Reporting and Getting Help

If you believe you are experiencing a subscription bombing attack, open a support ticket and include:

• The affected email address(es)
• Approximately when the flood started

Our team can review your mail flow logs to confirm the diagnosis and advise on whether any targeted filtering options apply to your specific situation.