Yes, this is an attack
If your inbox is suddenly filling up with confirmation emails, welcome emails, and newsletter opt-ins from dozens or hundreds of services you never signed up for, you're experiencing a registration bomb attack. Someone has taken your email address and submitted it to thousands of online signup forms simultaneously. Each service then does exactly what it's supposed to do: send you a confirmation email. None of those emails are spam in the traditional sense. That's what makes it so effective.
Why they're doing it
The flood is almost never the point. It's a distraction. While your inbox is paralysed under hundreds of thousands of emails, something else is happening: a fraudulent bank transfer, a password reset on one of your accounts, or an account takeover. The attack is designed to bury the confirmation of that action somewhere in the noise so you don't notice until it's too late. Check your bank accounts and any linked services immediately.
What to do right now
First: don't try to unsubscribe from everything. It will take hours, signal to the attacker that the address is active, and won't help with the next attack. Instead, create a filter that moves anything arriving in the next few hours to a separate folder, then go through your bank accounts, email account recovery options, and any financial services linked to your email. Look for anything that shouldn't be there.
How to find the email that matters
Sort your inbox by sender, not by time. The fraudulent transaction confirmation or password reset you're looking for will typically come from a sender you recognise: your bank, PayPal, a payroll system. Filter out the obvious noise (Reddit, LinkedIn, random newsletters) and focus on senders that have financial or account access significance. Act on anything suspicious immediately.
How to prevent it happening again
If this has happened once, your email address is on a list. It can happen again. The only permanent solution is an email gateway that sits in front of your mail server and detects the burst pattern before the flood reaches your inbox. MX Moat does this within 3-5 minutes of an attack starting, not through content filtering, but by recognising the network-level pattern of hundreds of first-time senders arriving simultaneously.