SynoPower Club-punkt:<\/strong> I spent years on the support side of Synology, and the most common worry I heard about self-hosting was that one bad night would take the site down. This one did not. The NAS kept serving pages, the store kept taking orders, and the only symptom was ten odd lines in the form entries. What made the difference was having everything in one place: the form entries, the mail log and the visitor IPs all lived on the same Synology box, so tracing the email bombing took one sitting instead of three support tickets to three different hosting companies.<\/p>\n<\/blockquote>\n\n\n\n Email bombing does not need to break into anything. The attacker takes a victim’s address and types it into as many public forms as possible: newsletter sign-ups, account registrations, and contact forms that send a copy of the message back to the sender. Each website then sends a real, correctly signed email to the victim. None of those messages is spam in the technical sense, so they sail past filters and pile up in the inbox.<\/p>\n\n\n\n The goal is rarely the flood itself. Microsoft Threat Intelligence has documented groups that use email bombing as a first step, then phone the victim pretending to be the IT help desk that will fix the spam problem. Other attackers use the flood to hide a bank alert, a purchase confirmation or a password change notice while they misuse a stolen account.<\/p>\n\n\n\n Contact forms are attractive because many of them auto-reply to the address typed in the email field. For the attacker that is a free, anonymous mail relay with a trustworthy sender name. For the site owner it means your domain is sending mail to people who never asked for it, and some of them will press the spam button.<\/p>\n\n\n\n The pattern was obvious once we looked at the entries side by side. Between the evening of 24 September and the next morning, our support form received ten submissions, spaced one to two hours apart. That slow pace is deliberate: it stays under most rate limits and looks like ordinary traffic.<\/p>\n\n\n\n None of these people had ever visited SynoPower Club. Our confirmation email, with a subject like SynoPower #1234 : Product Inquiry, went to each of them. If you received one of those messages and never contacted us, you were a target of email bombing: your address was entered by someone else. No account was created for you and nothing was charged. Our guide on how to tell if an email is really from SynoPower Club<\/a> lists every address we send from.<\/p>\n\n\n\n Our form already had two defences against spam switched on, yet the email bombing went straight through them: Cloudflare Turnstile and a hidden honeypot field. Both did their job, and neither was built for this.<\/p>\n\n\n\n A honeypot catches scripts that fill in every field on the page, including one hidden from humans. These submissions came from a real browser that only filled the visible fields, so the trap stayed empty. Turnstile checks whether the visitor behaves like a real browser and person. Every one of the ten entries carried a valid Turnstile token, which tells us the sender was using a genuine browser at a human pace, not a crude script.<\/p>\n\n\n\n That is the honest limit of bot checks against email bombing. They make mass automated abuse expensive, but a patient sender who submits one form an hour through a normal browser looks exactly like a customer. Stopping it needs a signal about where the request comes from, not just how it behaves.<\/p>\n\n\n\n Because the whole stack runs on one Synology system, the investigation never left the NAS. These are the four checks we ran, in order, and they work for any WordPress site hosted in Container Manager or Web Station.<\/p>\n\n\n Open the entries list of your form plugin and sort by date. Look for random names or messages, repeated topics and a steady interval between submissions, then note the IP address stored with each entry.<\/p>\n<\/div>\n<\/div>\n Open the mail log of your SMTP plugin, or the delivery log in Synology MailPlus Server, and search for the entry numbers. This shows whether your site actually sent a confirmation to each address and whether it was delivered.<\/p>\n<\/div>\n<\/div>\n Download the Tor Project bulk exit list and search it for each IP from the entries. In our case all ten addresses were Tor exit nodes, while none of the 199 genuine entries since 2024 came from an address on that list.<\/p>\n<\/div>\n<\/div>\n Make sure the IPs in your logs belong to visitors and not to Cloudflare or your reverse proxy. If every entry shows the same few addresses, restore the original visitor IP before drawing any conclusion.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n\n\n\n The fix for the email bombing had to meet two conditions: stop this sender completely, and not add friction for the customers who use the form to ask about licenses every week. We settled on one targeted change.<\/p>\n\n\n\n Form submissions that arrive through the Tor network are now refused, on every form on the site. Cloudflare marks Tor traffic with the special country code T1, and we also check the visitor IP against the Tor Project exit list, refreshed daily, so the rule still holds if a request ever reaches the NAS without passing through Cloudflare. Anyone refused sees a short message with our support address, so a genuine customer who prefers Tor can still reach us by email.<\/p>\n\n\n\n Browsing, checkout and account pages are untouched. The change only applies at the moment a form is submitted, which is exactly where the abuse happened.<\/p>\n\n\n\n The strongest defence against email bombing through a form is to stop sending anything to the address typed into it. If the form only notifies you, an attacker gains nothing by entering a stranger’s address. We weighed that option seriously.<\/p>\n\n\n\n We chose to keep the confirmation. Many of our customers write in because a license key did not activate or an order email went to spam, and an immediate reply that says we received the message, with a ticket number, lowers their stress a lot. Removing it would punish every real customer to inconvenience one sender.<\/p>\n\n\n\n The trade-off is clear, though. Blocking Tor closes the route this sender used, but a determined attacker could switch to ordinary proxies. If junk entries return from non-Tor addresses, the next step is to make the confirmation optional or turn it off, and that decision belongs on your checklist before it happens, not during the next incident.<\/p>\n\n\n\n Step 4 of the investigation deserves its own section, because it is the most common trap when a self-hosted site deals with email bombing or any other abuse. A request to SynoPower Club passes through Cloudflare, then the reverse proxy in Synology DSM, before it reaches WordPress in its container. Without extra configuration, WordPress sees the address of the last hop, so every form entry, comment and order is recorded with a Cloudflare or proxy IP.<\/p>\n\n\n\n Cloudflare passes the original address in the CF-Connecting-IP header, and Apache can be told to trust that header only when the request comes from Cloudflare or your own proxy. We had fixed this only days earlier for fraud screening on orders, and it paid off immediately: the form entries showed the true Tor exit addresses, which is what made the pattern visible in minutes.<\/p>\n\n\n\n If you host on a Synology NAS behind Cloudflare, check this before you need it. Submit a test entry from your phone on mobile data and confirm the stored IP matches the one your phone reports.<\/p>\n\n\n\n A store that sells Synology licenses should be able to run on Synology, and ours does, all of it. Virtual Machine Manager<\/a> hosts the Virtual DSM instance that holds the site, Container Manager runs WordPress and its database, and Synology MailPlus<\/a> sends every order confirmation, license delivery and form reply.<\/p>\n\n\n\nWhat Email Bombing Is and Why Contact Forms Are Targets<\/h2>\n\n\n\n
How Email Bombing Showed Up on Our Synology-Hosted Store<\/h2>\n\n\n\n
\n
![\"Email](\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/09\/email-bombing-form-entries.webp\")
Why Turnstile and a Honeypot Did Not Stop It<\/h2>\n\n\n\n
Tracing Email Bombing on a Synology NAS in 4 Steps<\/h2>\n\n\n\n
Read the form entries<\/h3>\n
Check who received mail<\/h3>\n
Compare IPs with the Tor list<\/h3>\n
Confirm the IPs are real visitors<\/h3>\n
![\"WordPress](\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/09\/email-bombing-mail-log.webp\")
What We Changed After the Investigation<\/h2>\n\n\n\n
Should You Keep the Auto-Reply After Email Bombing?<\/h2>\n\n\n\n
Getting the Real Visitor IP Behind Cloudflare and Synology Reverse Proxy<\/h2>\n\n\n\n
Why We Run SynoPower Club on Synology<\/h2>\n\n\n\n
![\"WordPress](\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/09\/synopower-club-on-virtual-dsm.webp\")