Spamming Tools 2026: Bombers, Mailers & Senders

[Blackhatpakistan]

Every spam stack ever assembled eventually reduces to the same three questions: what software sends the mail, where the sending identity comes from, and whether the message lands in the inbox or the folder nobody opens. The GitHub open-source layer answers the first question honestly, because nobody repackages a Python mail-merge script to steal your wallets - it is too boring to weaponize. That makes GitHub the cleanest cross-section of real-world spam tooling you will find: bombers, bulk mailers, merge engines and workflow templates, all with visible code, visible age and visible star counts. Below: a categorized map of the 2026 open-source mail-abuse stack with live repository links, a threaded mailer you can read in five minutes, an inbox-placement checker that answers the only metric that matters, and the deliverability rules that separate a tool that sends from a tool that lands.

TL;DR - Three classes of tool live on GitHub. Bombers (EmBomber, 136 stars, Gmail/Yahoo/Outlook targets) hammer one address through provider SMTP with threads and delays - useful for testing your own account's abuse limits, lethal against nothing else. Bulk mailers (Mass-Mailer with SMTP plus mail-merge plus rate-safe delays, Bulk-Email-Sender with unique-subject rotation, BulkMailer, spam-script) do the real work: list in, HTML out, per-recipient personalization, throttled delivery. The modern layer adds n8n/Google-Sheets workflow templates with randomized copy, and gophish (the phishing-framework standard) for the security side of the same mechanics. Two code blocks below: a threaded SMTP mailer with hard rate limiting, and a seed-placement checker that polls your test inboxes across folders to compute the only number that matters - inbox placement rate. The deliverability stack behind every working sender: dedicated sending domain, SPF/DKIM/DMARC aligned, IP warmup curve, seed list monitoring, complaint-loop hygiene. Six-question self-check, then the scoreboard: post tool, daily throughput, seed inbox rate and your worst burn - best teardown pinned, first fifteen get the warmup-schedule template.

THE BOMBER CLASS: VOLUME AT ONE ADDRESS

Bombers are the entry drug and mostly a dead end, which is worth understanding rather than mocking. The pattern: take an email account (Gmail, Yahoo, Outlook - the big three are supported everywhere), open N threads, and fire M copies of a message at one target address through the provider's own SMTP relay. EmBomber is the reference - 136 stars, Python, supports Gmail/Yahoo/Hotmail/Outlook, threads configurable, subject and body customizable. eldomiklk/Email-Bomber (26 stars) is the same design trimmed to essentials, RIP-Network/Email-Bomber (16 stars) wraps it with an Outlook-account requirement, SagarBiswas-MultiHAT/EmailBomber (35 stars) adds format validation, and Trehwmm/Email-Bomber-SMTP is a VB.NET variant actively updated this year that extends into SMS payloads.

What they demonstrate, mechanically: provider rate limits are a function of account age, sending history and authentication - a fresh account dies at a few dozen messages, a warmed account absorbs a few hundred before the provider throttles, locks, or demands a captcha. That ceiling is exactly why serious operations never bomb: the sending identity burns faster than it can be replaced. The engineering lesson transfers though - threading models, delay jitter and connection reuse are the same primitives the bulk mailers use at 10x the volume with 10x the restraint.

THE MAILER CLASS: THE ACTUAL WORKHORSES

- Sabriigsxr/Mass-Mailer - Python, SMTP plus mail-merge plus rate-safe delays, Eel-based desktop GUI. The most complete "read it and understand sending" repository on the list.
- sanskar-singh-rajput/Bulk-Email-Sender - C# with HTML bodies and unique-subject rotation so successive messages do not stack into one thread at the receiver.
- paulobichara/BulkMailer - Java, connects via SMTP or an external provider API - the dual-path pattern most commercial tools still use.
- byronxu99/spam-script - TypeScript mail-merge, proof the mechanics translate to any language.
- yorubadeveloper/bulk_email - notable for its one-second inter-mail sleep, a bare minimum of the throttling discipline everything else preaches.
- OriginalAlex/EmailSpammer - Java, bulk from Gmail accounts, shows the multi-account fan-out pattern.
- Trehwmm/Email-Bomber-SMTP - straddles both classes: bulk mail and SMS from VB.NET, updated hours ago when you check.
- n8n template: randomized-template outreach - the 2026 shape of things: a workflow pulling contacts from Google Sheets, rotating message templates, randomizing send intervals. No code to audit, just nodes.

THE MAILER: READABLE CORE

Strip every repository above to its skeleton and this is what is left - list reader, merge, connection pool, throttle, log. Read it once and every other mailer on GitHub is a variation. Built-in: per-recipient personalization from a CSV, one SMTP connection reused across sends, a hard floor between messages, and a stop condition when the provider starts refusing, because hammering a throttle is how sending domains die.

import smtplib, csv, time, random, sys

from email.mime.multipart import MIMEMultipart

from email.mime.text import MIMEText

HOST, PORT, USER, PW = "smtp.example.tld", 587, "sender@example.tld", "REDACTED"

DELAY_FLOOR, DELAY_CEIL = 2.0, 6.0   # seconds between messages, jittered

MAX_FAILS = 5                        # provider pushing back = stop, do not fight

def load_template(path="body.html"):

    return open(path, encoding="utf-8").read()

def send_one(conn, row, template):

    msg = MIMEMultipart("alternative")

    msg["From"] = USER

    msg["To"] = row["email"]

    msg["Subject"] = row.get("subject", "A message for " + row.get("name", "you"))

    body = template

    for k, v in row.items():

        body = body.replace("{{" + k + "}}", v)

    msg.attach(MIMEText(body, "html"))

    conn.sendmail(USER, [row["email"]], msg.as_string())

conn = smtplib.SMTP(HOST, PORT, timeout=30)

conn.ehlo(); conn.starttls(); conn.ehlo()

conn.login(USER, PW)

tpl, fails, sent = load_template(), 0, 0

for row in csv.DictReader(open("list.csv", encoding="utf-8")):

    try:

        send_one(conn, row, tpl)

        sent += 1

        print("ok", sent, row["email"])

        time.sleep(random.uniform(DELAY_FLOOR, DELAY_CEIL))

    except smtplib.SMTPResponseException as e:

        fails += 1

        print("smtp", e.smtp_code, row["email"])

        if fails >= MAX_FAILS:

            print("provider pushing back - stopping run"); break

        time.sleep(15)               # back off, reconnect, reassess

conn.quit()

THE ONLY METRIC: INBOX PLACEMENT

Sent is not delivered, and delivered is not inbox. The checker below closes the loop the mailers leave open: after a run, it logs into your seed accounts (Gmail, Outlook, whatever you test with), searches every folder for the campaign marker, and computes placement rate - plus where the misses landed, which tells you whether the problem is content (spam folder), authentication (rejection) or reputation (filtered before arrival). Run it after every test batch; a placement drop is the earliest warning that a sending domain is burning.

import imaplib, sys

# seed inboxes to poll; marker = unique string in your test message

SEEDS = [

    ("imap.gmail.com", "you+1@gmail.com", "app-password"),

    ("outlook.office365.com", "you+2@outlook.com", "app-password"),

]

MARKER = "CAMPAIGN-2026-01"

def placement(host, user, pw):

    m = imaplib.IMAP4_SSL(host, 993)

    m.login(user, pw)

    hits = {}

    for folder in ("INBOX", "[Gmail]/Spam", "Junk", "Archive"):

        try:

            m.select('"' + folder + '"', readonly=True)

            code, data = m.search(None, 'BODY "' + MARKER + '"')

            if data[0]:

                hits[folder] = len(data[0].split())

        except Exception:

            continue

    m.logout()

    inbox = hits.get("INBOX", 0)

    other = sum(v for k, v in hits.items() if k != "INBOX")

    return inbox, other

total_ok = 0

for host, user, pw in SEEDS:

    try:

        ib, ot = placement(host, user, pw)

        total_ok += 1 if ib and not ot else 0

        print(user, "| inbox:", ib, "| elsewhere:", ot or "-")

    except Exception as e:

        print(user, "| check failed:", str(e)[:60])

print("placement:", total_ok, "/", len(SEEDS), "seeds clean")

WHAT THE TOOLS CANNOT FIX: DELIVERABILITY

Every repository above assumes a working sending identity, and that assumption is where 90% of runs die. The stack, in order: a dedicated sending domain (never your primary), SPF record authorizing the relay, DKIM signing with a key rotated quarterly, DMARC policy at least at quarantine while you monitor reports, an IP or domain warmup curve that starts at dozens of messages per day and doubles slowly over two to three weeks, and seed monitoring from day one - the placement checker above IS the monitoring. Skip warmup and even a perfect mailer lands in spam on day one; the tools are the easy part, and the open-source layer proves it by being freely available to everyone while deliverability stays scarce.

TEST YOURSELF: SIX QUESTIONS

Score honestly: (1) can you name the difference between a bomber and a mailer in operational terms? (2) does your send pipeline have a hard fail-stop when the provider throttles? (3) is your inter-message delay jittered or fixed? (4) do you seed-test placement after every batch? (5) is SPF/DKIM/DMARC aligned on the domain you send as? (6) what is your warmup curve - do you have one, or does volume start at full throttle? Zero to one: your sends are a bonfire of domains. Two to three: mechanics work, discipline missing. Four plus: you run a delivery operation - post it below.

POST YOUR SEND STACK

Scoreboard format: tool or repo you actually run, daily throughput, seed inbox rate (percentage, last run), and your worst burn - the domain or IP that died, what killed it, what you changed after. No lists, no addresses, numbers and mechanics only. Best teardown gets pinned, first fifteen posters get the warmup-schedule template (day-by-day volume curve plus seed-test cadence) via PM.

OPERATOR CHECKLIST

- Separate sending identity - dedicated domain and subdomain for mail, never the domain you would mind losing.
- Authentication before volume - SPF, DKIM, DMARC aligned and verified with a test send before the first real batch.
- Warmup is not optional - start dozens per day, double slowly, monitor placement the whole way up.
- Throttle with jitter - fixed delays fingerprint as bot traffic; randomized intervals with connection reuse look like a human mail client.
- Fail-stop on pushback - SMTP 4xx/5xx bursts mean the provider is throttling; stop, back off, reassess. Fighting the throttle burns the identity.
- Seed-test every batch - the placement checker costs minutes and catches reputation slides before your real metrics move.
- Honor suppression - bounces and complaints feed a suppression list that every future run respects. A list that keeps hitting dead addresses is training providers to hate you.

FAQ

- Q: Are these GitHub bombers usable for real campaigns?

A: As mechanics lessons, yes; as campaign tools, no. They lack warmup, placement testing and suppression handling - the three things that make a campaign survive a week.
- Q: What is the realistic daily volume for a warmed sending domain?

A: It is a curve, not a number: dozens on day one, low thousands by week two if placement holds, tens of thousands only with consistent engagement signals and clean complaint rates. Skip the curve and you learn the ceiling the hard way.
- Q: n8n workflow or Python script - which should a beginner start with?

A: The script. You cannot fix what you cannot read, and the Mass-Mailer plus the two blocks above teach the primitives that every workflow hides behind drag-and-drop nodes.
- Q: Why do unique subjects and randomized templates keep appearing in the repos?

A: Identical successive messages thread together at the receiver and fingerprint as bulk. Rotation defeats threading and keeps each message looking like an individual send - the AI-copy angle goes deeper in the related guide.
- Q: Does inbox placement testing require paid tools?

A: No - seed accounts and the IMAP checker above are free. Paid seed networks add breadth (more providers, more geographies); they do not replace the habit.
- Q: Where does phishing fit in this stack?

A: Same sending mechanics, different payload - gophish is the open standard for the security side, and understanding mailer internals is exactly what makes its reports readable.

RELATED

SMTP Mailers 2026 - The Complete Spamming Guide: Tools, Servers, Distribution, Deliverability

Spamming Methods 2026 - Complete Underground Guide

How Spammers Use AI to Write Undetectable Emails

Credential Stuffing 2026: How Breach Lists Kill Accounts - Check Your Exposure