Isn’t there a way to make this thread private?
I observe an increase on spam requests since few days. Many random-looking (but probably valid) gmail addresses.
1 Like
Since April I get suspicious looking sign ups from company domains:
kappel.casa
btstravel.be
grenuttag.com
zfg-amer.com
siteselectiongroup.com
conn-weld.com
ey.com
drecapital.com
supremelending.com
columbusglobal.com
mypremier.co.uk
reinhausen.com
marina-tracy.com
zabret.si
zipscarwash.com
variobend.de
leger360.com
joneswalker.com
cmcelectronics.ca
Anybody else got one of these domains as sign up?
I have a small private blog and these do not make too much sense to me.
1 Like
I think attack doesn’t really related with those domains at all. The email owners from these domains are other side of the victims. Attacker(s) collect email addresses, and use them for signup requests on Ghost sites. Blocking those domains will not help a lot.
For anyone who hasn’t seen it, Jannis wrote a good post on this topic today:
5 Likes
I suddenly got a bunch of signups on a memorial site from years ago.
From your list, I also have:
zfg-amer.com
columbusglobal.com
cmcelectronics.ca
zabret.si
And ones that aren’t there are:
superioracc.com
zoetis.com
bbraunusa.com
usicllc.com
egitape.com
slicedhealth.com
peopletrust.it
legrand.us
summitadvisors.com
bmmlogistics.com
roshel.com
I agree that blocking the domains won’t help. I’ve set verifyRequestIntegrity and will see if it helps. Strangely, having an extra ‘empty’ ghost installation seems to be a useful way to know what’s a true fake signup.
1 Like
Today I got many signups for the korper.nl.
Seems legit as well, but I blocked it now and added the name as a requirement.
I really would like to understand what they are trying to do. Seems so random.
Thinking of removing free signups and just ask for at least 2 Euros or so 
3 Likes
I really would like to understand what they are trying to do.
The same here
Is there a way to add:
- additional details for the sign up: motivation, profession
- review for the free tier subscription
Something like additional step which require human involvement?
There is a spike for integrating Cloudflare Turnstile to Ghost member signups: WIP: Added CF Turnstile to members signup by sam-lord · Pull Request #29136 · TryGhost/Ghost · GitHub
Turnstile is better from any other captcha solutions since it can work in invisible mode, or it will be just a checkbox, not solving annoying puzzles just for subscribing to a newsletter. But it may be concerning to use a 3rd party service for a critical functionality of Ghost.
I’m curious about the result of this work.
3 Likes
Sounds really promising!
Heads up that the verifyRequestIntegrity behavior is reportedly going to be enabled in core soon.
Depend on how it’s handled, the option might be removed with the only behavior being the same as true . If that’s the path taken, then verifyRequestIntegrity:true will cause no behavior change on future Ghost versions, as the check will only be happening.
2 Likes
Folks with custom built sign up forms (especially if 2024 or before) need to take a careful look at them, or risk some brokenness when the default changes. I’ve got sample code on my blog for how to get and use an integrity token.
1 Like
I don’t think the problem necessarily is human review, because people who signup are indeed going to their emails and confirming the signup (maybe accidentally…).
The problem is bots forcing the confirmation link send in the first place. And that is basically impossible to stop without a “web centralizer” like Cloudflare, as far as I know.
What we are going to do, I think, is just live with it, and run a script to delete spam-looking subscribers every week or so (our spam volume is relatively low).
1 Like
In case, someone else wants to integrate turnstile on their own.. I did so and documented it:
Maybe it helps someone: Secure Ghost Magic Links with Turnstile and Nginx
1 Like
Last week, I had a big client on Ghost Pro with a “sign in with google” integration get hit with a bunch of spammy signups. They were clearly bogus, because there was a "company name’ on a form behind them, and it got keyboard mashing responses. Signups appeared to be coming from an alphabetized list. Names appeared to be real (and were pulled from Google as part of the sign-in flow) and matched the email address in many cases. Rate was one every few minutes, for hours, from what might have been a rotating proxy. (1-2 requests per IP.) It didn’t look like a bot. It looked like a human with a ton of compromised/fake Google accounts, working through them one at a time. I disabled sign-in with google for new users, and the flood stopped.
Going on for several weeks: A big client on Ghost Pro has been getting a ton of extra sign-ups. It’s 100% gmail, and the addresses are nearly all like firstnamelastname<2-8digits>@gmail.com. They click magic links and get authenticated. I turned off free signups and put turnstile in front, but I won’t know if it worked until tomorrow, because the link clicks seem to come in hours after the subscribe action.
So… I’m stumped. It’s not the same method [the first attacker wouldn’t have been stopped if they did whatever the second is doing], but both seem to be an attacker with access to a ton of gmail accounts and a desire to be subscribed as a free member to these Ghost sites. Has it suddenly gotten a lot easier to create fake gmail accounts, or was there a big account compromise? Did the skript kiddies get a new tool?
I don’t know what the motivation is, either. These accounts don’t seem to DO anything, at least not immediately. It certainly /could/ be a long game (eg. the folks who sign up one month on the forum and start link spamming a month later)… but I’m stumped.
Blocking gmail is a non-starter. Rate-limiting doesn’t work on a sign up every minute or two, but that’s still ~1000 new fake members a day.
Thoughts? Ideas?
Thank you very much.
Did you inspect the IP addresses: ASN, AS Type etc.
If there is a pattern you can report abuse against the provider.
Is the geolocation info matching the subscriber data against the IP-s?
The motivation could be:
- Credential or email testing: test stolen or disposable email addresses and passwords.
- Spam or SEO abuse: Accounts may later be used to post links, promote products, or send spam.
- testing bots
- searching for vulnerabilities
- DOS
My client is at Ghost Pro, so we don’t have any IP or ASN access.
1 Like