Spam email sign ups from HeadlessChrome?

Question

I built a landing page with a "sign up with your email to get notified" sort of thing. The button executes some AJAX and submits to a PHP file which sends an email to me. Now, I'm getting a bunch of signups, but I've never advertised the link. I do see that it has been indexed by Google. These emails look semi-legitimate, but I checked my nginx access log and found they were all from HeadlessChrome (albeit from different IPs), and none of them have referers at all (I added the referer thing to the AJAX->PHP system).

So my question is: Is this spam or legitimate?

And as a follow-up, since I strongly believe this is spam, is this config in my nginx sufficient to fight it (given it's a tiny site) for now?

server {
 # (other stuff...)
        if ($http_user_agent ~ (HeadlessChrome) ) {
            return 403;
        }
}

Answer 1

Yes, it is spam.

I really doubt you have legitimate customers that subscribe to random forms using headless chrome.

No, it is not enough to block the user agent at nginx level. It would be trivial for an attacker to change the user agent, and even more so with your implementation to see you have blocked them.

At least, had you filtered it at the PHP file, you could tag them as malicious without hinting them. Anyway, just filtering the obvious cases doesn't mean you aren't receiving less-obvious ones as well.

An approach that can help to detect those is to build a database of blacklisted emails/ip addresses based on those known features. I suspect all of them to be spam, though.

The complete solution is that you should place a captcha system to avoid automatic sign-ups. And even then, to send before enrolling them in your mailing list.

There are two common reasons for doing this:

• First is that they expect their spam reaches to you.
• Second one is to provide the email address of a target they want to flood.
  • You need to provide a confirmation link before subscribing them in order to ensure the owner of the email address does want to receive your notifications.
  • You need a captcha in order to avoid flooding such targets with confirmation emails.

Please note that by not taking proper precautions, your form will be abused, and you will be penalized for that (your sending IP address, your domain more often ending up in spam, perhaps even your ISP getting complaints of your spam).

Answer 2

From my perspective this sounds like someone is trying to deliver some spam to you. I don't know why someone is doing this and what's his purpose but it looks like.

Regarding your question:

No it's not enough to deal with it that way. It's very easy for an attacker to alter the user agent and move on like before. I would strongly recommend to use recaptchas. So you don't need to deal with it on your own. It's kinda easy to implement and works against such crawler and bots very well.