3 ms·

That "spam distraction" tactic is scary - no doubt it's being used in the wild!

• sodality2 6y ago
  Surely so! I just spent a few hours signing up for newsletters I had saved previously and gathering submit POST requests, concatenating it into one script, etc. I honestly can't think of any white hat use for it (besides what I did). I haven't open sourced it, because it will probably be used for malicious purposes by script kiddies 99% of the time, and I don't really want that associated with me.
• iamacyborg 6y ago
  It was, a few years ago Mailchimp and a few other ESP's were subject to major listbombing attacks. https://wordtothewise.com/2016/08/subscription-bombing-esps-spamhaus/ https://wordtothewise.com/2016/08/subscription-bombing-esps-...
  • sodality2 6y ago
    Unfortunately nearly every mailing list sends a confirmation email. that's good enough for an initial flood... A better solution would be "send an email to newsletter@domain.com"! Very surprised this hasn't been implemented
    • LeifCarrotson 6y ago
      Ah, but then fewer people would "sign up for the newsletter" by failing to toggle the box on the checkout page. Then your list membership growth rate would go down! Can't risk that, no wonder it hasn't been implemented.
    • iamacyborg 6y ago
      Mailchimp turned off double opt-in as the default list behaviour, presumably as a result of this listbombing taking place. It eliminates the immediate flood from the listbomb attack but does mean the email address now has to opt-out from every list they've been susbcribed to. https://wordtothewise.com/2017/10/mailchimp-changes-signup-process/ https://wordtothewise.com/2017/10/mailchimp-changes-signup-p...