Ghost sign up and spam?

Using Ghost
41

Ghost CLI - 1.26.1
Ghost version - 5.107.2

20250126_072821
20250126_0728211920×1440 191 KB

42

You have nested the spam object under paths. It should be on the same level. You also have a typo in the property itself. It’s blocked_email_domains (singular email), not blocked_emails_domains.

This should work:

    ...,
    "process": "systemd",
    "paths": {
        "contentPath": ...
    },
    "spam": {
        "blocked_email_domains": [
            "txt.att.net"
        ]
    }
}
1 Like
43

made the change and worked, thanks Brent

44

Just want to chime in here with a warning to Mailgun users: do not bring any of this to the attention of their support team, or they’ll permanently disable your account.

I naively asked about our sending reputation after getting hit with just a few of these spam signups, and they suspended our domain, then our account, and then sent this:

Screenshot 2025-01-27 at 10.46.48 AM
Screenshot 2025-01-27 at 10.46.48 AM1658×662 55.3 KB

1 Like
46

Without context this does not mean much.

You might have a domain and spam people and this was just the last drop in the bucket.

You might be completely right and they are overreacting.

47

I didn’t think context or defense was needed, but no, there were no drops in the bucket. Even if there had been, no explanation was given, so it’s impossible to know. I never got beyond automated responses.

48

Context always matters.
The problem is, any company can deny doing business with you.
That just sucks.

That is why I am a bit worried about mailgun, being the only option for ghost.
Makes it hard for self-hosters.

49

Can someone explain how these bots/spammers/scammers are able to sign up using a non-existent page /membership/?

50

You can use any page for sign up when you hit the API with a python client for example.

I guess ghost does not forbid sign ups on non existing sites.
And forbidding this would not even solve the problem, they could do the same on your root domain.

51

Hey everyone,

This is my blocked email domains list so far:

[
  "txt.att.net", 
  "tmomail.net",
  "vtext.com",
  "mymetropcs.com",
  "msg.telus.com",
  "pcs.rogers.com",
  "fido.ca",
  "txt.freedommobile.ca",
  "sms.sasktel.com",
  "txt.bell.ca",
  "email.uscc.net"
]

I just added email.uscc.net today, as I am closely watching over my instance logs. I am sharing the list so that we can help each other keep an up to date blocked list of spammy domains.

I am also looking at Ghost’s commits and seems that two new functionalities are being cooked:

  • A user facing setting to allow publishers to update/add the list of blocked email domains directly from Ghost admin. This will most likely be added in the next release this week.
  • A functionality to enable captcha as part of our sign up flows.

Really exciting developments, and looking forward to start using these against the spammy traffic.

3 Likes
52

Hey Andrej!

That is why I am a bit worried about mailgun, being the only option for ghost.

This is something to be concerned about indeed. Do you use your own mail server instead of mailgun?

I wonder how much of a challenge is to maintain your own mail server, and also if you face any issues with deliverability rates, newsletter falling in spam folder because of not high enough reputation etc…

53

I have updated to the build with the spam filter, have added Juan’s version of the spam blocklist above, can confirm that if I try to test it myself I get an error — but other spam accounts are still somehow managing to sign up anyway? Not really sure what’s going on.

54

Are these definitely new sign-up events, and not delayed bounces from before you updated?

55

Pretty sure they’re new as I delete the spam accounts every time they sign up and these are newly registered members.

56

Possible you’re looking at magic links sent from before you updated? The block is on sending the magic link, not on them clicking it to activate, so it’s possible that you might still see some confirmations come in after you update.

Given that when you test manually, the block seems to be working, I might wait a bit to see if more subscriptions show up or not before deciding it isn’t working.

57

I guess that could be true; Mailgun is saying that nearly 800 emails have been sent and I haven’t had remotely that many signups (even with the spam ones) so I guess I likely have a lot of fake accounts sitting and waiting for activation.

58

Unfortunately, that’s a very real possibility. If you’re self hosting, you might clear out the relevant database table. There’s also a recent post that describes some automation for deleting junk accounts after verification - worth a look!

59

Thanks Cathy, I am self hosted but I’m not sure how I’d go about clearing the database table. I’m assuming it’s not a straightforward terminal command?

60

@mixvio I believe it’s the tokens table. It is automatically cleared every ~24 hours AFAIK. If you haven’t gotten any legit signups in that timeframe you could probably clear everything in it using the mysql command line interface on your server (or PHPMyAdmin or whatever).

1 Like
61

I’ve added vtest.com to my MagicPages custom block list as I’ve had several signups from there since yesterday that just bounce off the Amazon mailservers. Since the email doesn’t get through, these don’t appear as new Ghost subscribers, but the address format (9-10digits@) is similar, so I presume it’s the same sort of scam. I’ve got ~5,000 subscribers, none of which use vtest.com.

1 Like