Email bombing (also known as “list linking” or “email cluster bombing”) floods a user’s inbox with thousands of legitimate subscription or notification emails within a short time. These attacks are typically short but high in volume and can hide important security alerts in the noise.
The Email bombing recipient addresses list is accessible by selecting Settings → Lists → Other in XCC.
What this list does
When you add a recipient address to this list:
- More aggressive filtering of auto-generated emails is applied.
- The volume of newsletter and notification emails is reduced.
- The impact of an ongoing attack is limited.
Risk of false positivesAggressive filtering increases the risk of false positives.
Legitimate password resets, account notifications, or newsletters may be quarantined.
When to use it
Use this list only if:
- A user is actively experiencing an email bombing attack.
- The inbox is flooded with high volumes of auto-generated emails from many unknown domains.
- Manual sender blocking is no longer effective.
This is a temporary containment measure.
Operational guidance
- Add the affected address as soon as the attack is confirmed.
- Monitor the mailbox for false positives.
- Remove the address once the attack subsides.
- Report unique incidents to support@xorlab.com.
- Contact support for help with bulk isolation or unsubscribing affected users.
