# Auth attack through Zapier integration
**URL:** https://forum.ghost.org/t/auth-attack-through-zapier-integration/45917
**Category:** Integrations & API
**Created:** [March 21, 2024, 7:44pm UTC](https://forum.ghost.org/t/auth-attack-through-zapier-integration/45917 "2024-03-21T19:44:04Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Gergely\_Csaba\_Nagy](https://forum.ghost.org/u/Gergely_Csaba_Nagy)
#### Post date: [March 21, 2024, 7:44pm UTC](https://forum.ghost.org/t/auth-attack-through-zapier-integration/45917/1 "2024-03-21T19:44:04Z")
Hi there,
We have a self-hosted Ghost instance (running really well, I like it, thx!) and today I got 45 emails from the Ghost engine, saying that the Zapier integration failed. We don’t have any Zapier integrations set up.
Because of the URL-s the calls tried to reach, I think someone tried to attack the site authentication. (Failed request URL: `/resources/ghost/api/canary/admin/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd`)
Have you ever experienced something similar? Is there a way to close the Zapier port/connection?
---
### Author:  [@Zlatanera](https://forum.ghost.org/u/Zlatanera)
#### Post date: [July 23, 2025, 8:59am UTC](https://forum.ghost.org/t/auth-attack-through-zapier-integration/45917/2 "2025-07-23T08:59:31Z")
I just received a similar e-mail - Zapier connection is not enabled or configured in Ghost (and never was!).
What / Who could be triggering this?
---
### Author:  [@Kevin](https://forum.ghost.org/u/Kevin)
#### Post date: [July 23, 2025, 10:06am UTC](https://forum.ghost.org/t/auth-attack-through-zapier-integration/45917/3 "2025-07-23T10:06:36Z")
These messages aren’t coming from Ghost or Ghost’s own Zapier app/integration so it sounds like it could be phishing attempts.
Would you be able to forward the email you received to [kevin@ghost.org](mailto:kevin@ghost.org)?
---
### Author:  [@Kevin](https://forum.ghost.org/u/Kevin)
#### Post date: [July 23, 2025, 1:17pm UTC](https://forum.ghost.org/t/auth-attack-through-zapier-integration/45917/4 "2025-07-23T13:17:00Z")
Thanks for forwarding. I was mistaken, these emails _are_ being sent from Ghost; I’d searched our codebase but didn’t find the related code because it was removed a couple of months ago because the notifications were mostly useless/incorrect.
Looking at the old code, it has a bug where a request to an old versioned Admin API endpoint with no query param and no auth header would trigger the version-mismatch email for the first API key in the database which would always be the Zapier key.
In short, these requests are just the typical type of security-probing requests that every site on the public internet receives constantly. Aside from the incorrectly sent email the request is harmless and just gets a 404 response. Nothing to worry about, and if you upgrade to recent version of Ghost the notifications will go away.
---
### Author:  [@KBExit](https://forum.ghost.org/u/KBExit)
#### Post date: [July 23, 2025, 1:25pm UTC](https://forum.ghost.org/t/auth-attack-through-zapier-integration/45917/5 "2025-07-23T13:25:47Z")
I was going to say, the phisher are getting REALLY good lol.