# Huge influx of spam signups

**URL:** <https://forum.ghost.org/t/huge-influx-of-spam-signups/52613>\
**Category:** Using Ghost\
**Created:** [November 19, 2024, 4:28pm UTC](https://forum.ghost.org/t/huge-influx-of-spam-signups/52613 "2024-11-19T16:28:20Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![curiositry](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/curiositry/32/1084_2.png) [@curiositry](https://forum.ghost.org/u/curiositry)\
**Post date:** [November 21, 2024, 9:56pm UTC](https://forum.ghost.org/t/huge-influx-of-spam-signups/52613/5 "2024-11-21T21:56:08Z")

</div>

@Jason404media I had a similar problem, and ended up using CloudFlare WAF to block the user agent until the attacker gave up:

> [@Ghost subscribe form hit by spam signups, hurting sender reputation](https://forum.ghost.org/t/ghost-subscribe-form-hit-by-spam-signups-hurting-sender-reputation/49566/2):
>
> For anyone else with the same problem: I ended up capitulating and putting my blog behind Cloudflare, but even with bot fight mode activated, it didn’t help. However, a quick look in the actual logs showed that it was a very basic script kiddie attack, and even though the IPs seemed to change (mostly US and UK so far), they hadn’t bothered to spoof the user agent: "user-agent":"Python/3.12 aiohttp/3.9.5" So I added a Cloudflare Web Application Firewall (WAF) custom rule to block requests to /…

It looks like the intent behind the spam signups you’re getting might be different, though.

In my case, my Nginx logs showed that the send-magic-link endpoint was being hit directly, without going through the Ghost frontend. Ghost is working on tightening up that endpoint, which should help.

I’d like it if there was an option to validate signups against a deliverability API like Reacher, _before_ the confirmation email is sent.

In my case, the spam signups were hurting my email sending reputation, so the damage was done before a member created webhook would be run. But if you’re just trying to remove bad signups, you could probably use a custom integration to delete members that matched certain criteria.

---

_[View the full topic](https://forum.ghost.org/t/huge-influx-of-spam-signups/52613)._
