Observations about spam signups

Using Ghost
25

Hi everyone,

I’m dealing with a sustained spam attack similar to what others have reported here, but with a frustrating twist: my Cloudflare WAF rules aren’t working at all.

Current situation:

Three self-hosted Ghost blogs (Infomaniak VPS via Coolify) are being hit by bots attacking /members/api/send-magic-link. The pattern matches what @muratcorlu described in the opening post: SMS gateway addresses (@txt.bellmobility.catx@txt.att.net.b@vtext.comllmobility.ca, @txt.att.net, @vtext.com), 95%+ email failures (timeouts), and catastrophic Mailgun reputation damage (delivery rates dropped from 100% to 1.5-3%).

What’s NOT working:

Following @jannis’s recommendation (#18), I deployed Cloudflare WAF rules blocking Tor (country T1) on /members/api/send-magic-link. Result: zero blocked events in Cloudflare Analytics. The spam continues unabated.

After investigation, I discovered why: the bots are bypassing Cloudflare entirely by attacking my server IP directly. My Coolify setup exposes Ghost via Traefik on ports 80/443, making the server accessible from any IP. Even though my domains are proxied through Cloudflare (orange cloud), the bots simply hit the origin IP.

Mailgun logs confirm this: "originating-ip" shows my VPS IP (185.x.x.x), not the bot’s IP. Cloudflare sees zero traffic to the spam endpoint.

Infrastructure questions:

This raises a question about what @Kevin mentioned in the other thread: “This is something better handled at the various network levels above your Ghost instance.”

For self-hosters behind Cloudflare, what does “network level” actually mean when bots can bypass Cloudflare? The two obvious solutions are:

  1. Server-level firewall restricting ports 80/443 to Cloudflare IPs only (15+ firewall rules per VPS)

  2. Cloudflare Tunnel (but this breaks my setup where only subdomains are on the VPS while canonical domains host other apps)

Is this infrastructure hardening standard practice for self-hosted Ghost? If so, why isn’t it documented in Coolify or Ghost security guides? Am I missing something obvious here?

Proposal: Community-maintained blocklist

Separately, I think we need a better long-term solution than each site owner manually updating their blocklist. Inspired by repos like disposable-email-domains, what if we created a community-maintained blocklist of SMS gateway domains on GitHub?

Workflow:

  • Community members submit PRs when they discover new spam domains

  • Ghost users pull the updated list periodically (manually or via webhook/scheduled task)

  • Everyone benefits from collective intelligence instead of playing whack-a-mole individually

This wouldn’t solve the infrastructure problem (bots bypassing Cloudflare), but it would make the blocklist approach more maintainable for everyone. Thoughts? Would anyone be interested in collaborating on this?

Mailgun frustration:

One final note: Mailgun sent zero automated alerts despite weeks of 95%+ failure rates and drastic reputation degradation. I only discovered this by manually checking the dashboard. For others dealing with this, I’d recommend setting up your own monitoring.

Questions:

  1. For self-hosters behind Cloudflare: how are you preventing direct-to-origin attacks? Is firewall hardening or Cloudflare Tunnel the standard approach?

  2. For Ghost(Pro) users: @Kevin, could you share any details about how Ghost(Pro) handles this at the “network level” so self-hosters can learn from it?

  3. Would anyone be interested in collaborating on a GitHub-based community blocklist for SMS gateway domains?

Thanks, Bastien