The scenario is that a website has a password recovery feature: you enter your email and if you have an account with that email, it sends you a recovery link.

But then someone writes a script that requests a recovery every 5 seconds all day long and gives someone else's email to:

  • harass that person
  • waste site resources sending emails
  • get the site blacklisted as a spammer
  • other unpleasant consequences

To be clear, the attacker doesn't compromise the site, but just causes grief of different kinds via that site emailer channel. Does this have a name?

1 Answer 1


As far as I know, the attack that you described is known as "Password reset email spamming", "Password reset email bombing" or just simply "email flooding".

Taking the definition from Techopedia:

Email Bomb:

An email bomb is a form of Internet abuse which is perpetrated through the sending of massive volumes of email to a specific email address with the goal of overflowing the mailbox and overwhelming the mail server hosting the address, making it into some form of denial of service attack.

An email bomb is also known as a letter bomb.

Also the definition from Cloudmark Security Blog says:

DDoS attacks are not limited to websites. We are currently seeing some email inboxes being attacked by being inundated by blog forum sign up confirmation and password reset emails. A DDoS attack on an inbox is known as mail bombing, and it is a technique sometimes used by cyber criminals to cover up a more serious attack.

I also include two links where both terms mentioned before are used in a similar attack to the one you described, these attacks were reported on www.hackerone.com as part of a bug bounty:

If you want to read more about this attack, I include some extra links:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .