Isn’t there a way to make this thread private?
I observe an increase on spam requests since few days. Many random-looking (but probably valid) gmail addresses.
1 Like
Since April I get suspicious looking sign ups from company domains:
kappel.casa
btstravel.be
grenuttag.com
zfg-amer.com
siteselectiongroup.com
conn-weld.com
ey.com
drecapital.com
supremelending.com
columbusglobal.com
mypremier.co.uk
reinhausen.com
marina-tracy.com
zabret.si
zipscarwash.com
variobend.de
leger360.com
joneswalker.com
cmcelectronics.ca
Anybody else got one of these domains as sign up?
I have a small private blog and these do not make too much sense to me.
1 Like
I think attack doesn’t really related with those domains at all. The email owners from these domains are other side of the victims. Attacker(s) collect email addresses, and use them for signup requests on Ghost sites. Blocking those domains will not help a lot.
For anyone who hasn’t seen it, Jannis wrote a good post on this topic today:
5 Likes
I suddenly got a bunch of signups on a memorial site from years ago.
From your list, I also have:
zfg-amer.com
columbusglobal.com
cmcelectronics.ca
zabret.si
And ones that aren’t there are:
superioracc.com
zoetis.com
bbraunusa.com
usicllc.com
egitape.com
slicedhealth.com
peopletrust.it
legrand.us
summitadvisors.com
bmmlogistics.com
roshel.com
I agree that blocking the domains won’t help. I’ve set verifyRequestIntegrity and will see if it helps. Strangely, having an extra ‘empty’ ghost installation seems to be a useful way to know what’s a true fake signup.
1 Like
Today I got many signups for the korper.nl.
Seems legit as well, but I blocked it now and added the name as a requirement.
I really would like to understand what they are trying to do. Seems so random.
Thinking of removing free signups and just ask for at least 2 Euros or so 
3 Likes
I really would like to understand what they are trying to do.
The same here
Is there a way to add:
- additional details for the sign up: motivation, profession
- review for the free tier subscription
Something like additional step which require human involvement?
There is a spike for integrating Cloudflare Turnstile to Ghost member signups: WIP: Added CF Turnstile to members signup by sam-lord · Pull Request #29136 · TryGhost/Ghost · GitHub
Turnstile is better from any other captcha solutions since it can work in invisible mode, or it will be just a checkbox, not solving annoying puzzles just for subscribing to a newsletter. But it may be concerning to use a 3rd party service for a critical functionality of Ghost.
I’m curious about the result of this work.
3 Likes
Sounds really promising!
Heads up that the verifyRequestIntegrity behavior is reportedly going to be enabled in core soon.
Depend on how it’s handled, the option might be removed with the only behavior being the same as true . If that’s the path taken, then verifyRequestIntegrity:true will cause no behavior change on future Ghost versions, as the check will only be happening.
2 Likes
Folks with custom built sign up forms (especially if 2024 or before) need to take a careful look at them, or risk some brokenness when the default changes. I’ve got sample code on my blog for how to get and use an integrity token.
1 Like
I don’t think the problem necessarily is human review, because people who signup are indeed going to their emails and confirming the signup (maybe accidentally…).
The problem is bots forcing the confirmation link send in the first place. And that is basically impossible to stop without a “web centralizer” like Cloudflare, as far as I know.
What we are going to do, I think, is just live with it, and run a script to delete spam-looking subscribers every week or so (our spam volume is relatively low).
1 Like