Unwanted email signups are confirmation and welcome messages sent to an address for services its owner never joined. Most signup forms accept any typed address without checking that the typer owns it, so a typing error, an automated bot, a deliberate signup flood, and plain mischief all produce the same visible result, and the pattern of arrival, the number of senders, and the timing indicate the cause and the response.
Signup form validation
A signup form performs two distinct operations that are often confused: collection of an address and confirmation that the address belongs to the person who typed it. Many forms perform only the first operation. A form that sends a welcome message immediately, with no confirmation step, treats the typed address as valid. A form with double opt-in sends a confirmation link first and adds the address to the list only after the link is clicked, which stops an unconfirmed address from becoming a subscriber, but the confirmation message itself is still sent once, as Site AI Audit explains in its guide to signup form abuse.
The same gap admits all four causes, so a single message carries little diagnostic value on its own. A mistyped address, a harvested address fed to a bot, a deliberate flood, and a prank all pass through forms that do not validate ownership before sending mail. No reliable public data separates typo-driven signups from bot-driven signups in ordinary inboxes, so this article gives no proportions for the four causes and describes the mechanism, the documented scale, and the checks reported by security sources instead.
Typographical errors
A typing error produces a trickle of mail from one service or a small number of services. One person types an address from memory, drops a digit, swaps two letters, or confuses a similar name, and the result lands in a stranger's inbox. The other person usually believes the address is theirs or belongs to someone they know, and has no interest in the stranger who received the mail. Google describes exactly this pattern for Gmail: adding dots does not change a consumer Gmail address, so dots are not the explanation when mail for someone else arrives, and the sender probably mistyped or misremembered the address, as stated in Google's guidance on dots in Gmail addresses.
A related mix-up involves recovery addresses. A person setting up a new account sometimes enters someone else's address as a backup or recovery address, and the stranger then receives a confirmation for an account that is not theirs. One published account of this pattern describes a Gmail recovery confirmation arriving for an account the recipient never created, with a disconnect option in the message itself, as described in Ask Dave Taylor's account of a stranger's recovery email. The response is narrow in both cases: contact with the sender and a request for removal, or an unsubscribe from the list, usually ends the flow, and a typo signup does not indicate mailbox access or predict further signups.
Automated bots
Automated bots turn a single address into many signups. A script takes an address, often taken from breach data or a public source, and submits it to signup forms across the web, and each form responds with a confirmation or welcome message. MITRE ATT&CK technique T1667 describes this mechanism directly: an automated bot registers a targeted address for email lists that do not validate new signups, such as online newsletters, and the result is a wave of thousands of messages that overloads the inbox. The pattern is volume from many unrelated senders in a short window, rather than a trickle from one service, and the address functions as a target selected because it was available, not as a customer of the services involved.
Bot signups also explain why spam filters miss the mail. SpyderMail's explanation of subscription bombing notes that almost every message in such a flood is genuine, sent by real marketing platforms that authenticate correctly with SPF and DKIM, with no forged sender, no malware, and no bad link for a content filter to object to. The signal that something is wrong is not in any single message. It is in the pattern across thousands of them, which is why grouping the mail by sender, or filtering it into a separate folder for later review, is more practical than treating each message as a separate problem.
Signup bombing
Signup bombing, also called subscription bombing or list bombing, is the deliberate, high-volume version of bot signups. An attacker enters one address into thousands of forms at once, and the inbox fills with confirmations. Proofpoint reports that a subscription bombing attack delivers over 1,500 emails per hour, designed to render an inbox unusable within minutes. Security reporting consistently describes the flood as a smokescreen: while the inbox is unusable, a fraud confirmation, a password change notice, or a purchase receipt can arrive unnoticed inside the noise. Material Security describes the same structure, noting that an email bomb floods an inbox with hundreds or thousands of messages in a short window, usually to bury a real alert, set up a follow-on social engineering call, or harass the target. Cleanfox makes the same point, describing subscription-based attacks as a smokescreen that conceals fraud confirmations and other serious threats.
The scale of the tactic is documented, not anecdotal. A 2026 peer-reviewed study cited by Uptime Web Hosting analysed 24 real campaigns containing 46,970 unwanted emails, many sent by legitimate third-party services. The tactic also has a documented history: the US Health Sector Cybersecurity Coordination Center described a 2016 attack in which thousands of government email inboxes were flooded with subscription requests and rendered unusable for days, as reported by TechTarget and by HIPAA Journal. No published measurement was found for how often a signup bomb actually hides a fraud attempt, so the guidance describes the risk and the check, not a rate.
Published guidance on subscription bombing describes searching a flood for payment, order, password and security terms before deleting any of it, because a fraud confirmation or account-change alert can sit inside the noise.
The response to a signup bomb therefore starts with preservation, not cleanup. Uptime Web Hosting stresses the first response: messages should not be mass-deleted, but searched first for hidden purchase, password-reset and account-change alerts, and financial accounts should be checked directly through their official apps or websites rather than through links in the flood. Only after that check do the bulk measures follow: filtering, quarantining, or unsubscribing from the flood in bulk, and MITRE notes the risk of an unsolicited support call offering to fix the flood.
Plain mischief
Plain mischief is the fourth cause, and the hardest to prove. A person enters someone else's address into signup forms because they want to annoy that person, settle a grudge, or watch the inbox fill. The mechanism matches a bot signup, but the scale is usually smaller and the sender list is chosen by hand rather than by script, so the result is a steady flow of unwanted mail that stops when the person stops, or continues for as long as the lists keep sending. Unlike a typo, the signups are deliberate, and unlike a signup bomb, the goal is usually disruption itself rather than a hidden fraud. The identity of the person behind the signups is usually not visible in the messages, which list only the services that sent them, and the response is the same set of recipient controls used for other unwanted signups: unsubscribe, block, or filter the senders, with a report of the pattern if threats or harassment accompany it.
Comparison of the four causes
The table below is a diagnostic aid, not a proof. A trickle can still be deliberate, and a flood can still be a mistake at scale. The pattern narrows the cause; it does not settle it.
| Cause | Typical pattern | Main risk | First response |
|---|---|---|---|
| Typographical error | A trickle from one or two senders | Ongoing unwanted mail from a stranger's accounts | Contact the sender or unsubscribe |
| Automated bots | Volume from many unrelated senders | Inbox overload and wasted cleanup time | Group by sender and filter the wave |
| Signup bombing | Thousands of confirmations in an hour | Hidden fraud or account changes buried in the noise | Search for alerts, then check accounts directly |
| Plain mischief | A steady flow from chosen services | Harassment and disruption | Unsubscribe, block, or filter the senders |
Containment by address
The four causes share one property: none of them can be prevented by the recipient. As a Microsoft support answer puts it, there is nothing the address owner can do to prevent someone from signing up to a website using any email address, and the safeguard is the confirmation step that the website may or may not perform, as stated in Microsoft's Q&A on an account created with someone else's address. Google states the same limit for dotted Gmail versions: Google cannot prevent people from accidentally or maliciously using a dotted version of an address to sign up for subscription emails. Prevention is therefore the wrong frame, and containment is the workable one.
When a real address is given to every site, every signup, bot submission, prank and bomb lands in the same inbox, mixed with bank alerts, order receipts and personal mail. When each site receives its own alias, the mail for that site lands in one forwarding address. A signup bomb against that alias is still a flood, but it is a flood inside one container: the alias can be paused, and the flood stops reaching the main inbox, while every other alias keeps working. The damage is bounded by the address that was exposed, not by the whole inbox, and the limit of containment sits inside that description: pausing an alias stops future forwarding, it does not remove the address from lists it already joined, and it does not undo signups that already happened.
AliasFleet per-site aliases
AliasFleet provides a separate email alias for each website, forwarded to the owner's real inbox, so that the website never receives the real address. If a site's alias starts receiving signups the owner never made, the alias can be paused or deactivated, and mail to that alias stops reaching the inbox. Other aliases are unaffected, because each alias is a separate forwarding address.
AliasFleet does not prevent signups from being submitted. No forwarding service can, because the submission happens on the other site's form. What per-site aliases change is the blast radius: a typo, a bot, a prank or a bomb aimed at one alias touches one alias. The main address stays out of the signup lists entirely, because it was never given to the site in the first place.
Response measures
For genuine lists, Gmail provides a subscriptions view that lists active subscription senders in one place and unsubscribes the owner from all active mailing lists related to a sender, as described in Google's guidance on managing subscriptions in Gmail. Google notes that it can take a few days for a sender to process an unsubscribe, and that blocking a sender does not unsubscribe the owner from the list; blocked mail goes to spam instead.
For commercial mail, the US Federal Trade Commission states that a sender must honour an opt-out request within 10 business days, as set out in the FTC's CAN-SPAM compliance guide. That rule gives an owner a concrete expectation for genuine marketing mail, and a concrete point at which continued mail after an opt-out becomes a complaint matter rather than a patience matter. Mailflow Authority's list-bombing guide adds the sender-side measures that reduce future floods: double opt-in, rate limits per IP address, CAPTCHA on signup forms, and suppression of addresses that never confirmed. Those measures belong to site owners, but they explain why some sites generate floods and others do not.
Top comments (0)