Email form abuse on Ghost (no CAPTCHA)

[jannis]

@muratcorlu shared lots of his findings here:

Observations about spam signups

I’m observing spam signup behaviors on Synaps Media since a while, and noticed some patterns that I wanted to share. Spam signup requests (to /members/api/send-magic-link/ endpoint) comes from a wide range of IPs. I checked some of the popular IPs on our platform and noticed that they are mostly coming from some servers or Tor Network. Because Tor Network IPs are mostly the IP addresses of individual people and Tor Network is also used for privacy considerations in some countries, I’m not confi…

What helped to mitigate these on Magic Pages (and Synaps Media, as far as I am aware) is blocking Tor traffic on the /members/api/send-magic-link endpoint.

Cloudflare specifically has the country code T1 for that:

Country - IP Access rules parameters

PS: I have personally not observed traffic coming through NordVPN – though if you see patterns and use Cloudflare or similar providers, that would probably also mitigate that.