Whenever i get a new user on one of my websites i get a message saying "New user signed up!" and i mean this is super rare, im not much of a marketer...
But one day it started happening a lot, and it grew! I'd have ca 20 new users per day. I mean i dont have captchas or other fancy stuff, simple email password sometimes username. Then you'd get sent an email saying "press this link to verify your account!" Honestly i dont really care to protect it more, i'd love to solve a signup bombing when it happens.
But this was strange, users signing up? to MY websites? am i about to be the next Zuckerfart?! No not really, checking the db and i see the users arent doing anything besides signing up?
First of all, i set the backend to ping me before they even pressed the signup link. I was a very optimistic developah. so even fakers will tell me they signed up. So that's it right? probably bots not verifying.
First fix
I setup the new user message to only be sent once verification was true. Suddenly silence, for about a month. Then it started again, pings came in few at a time, then suddenly more and more users per day. Now im back at 20 users per day. For sure the next Jeff Queso is yours truly. But the users arent doing anything? They just signup and verify their email.
Now this is strange and also pretty cool tbh.
I mean i have hermes agents that i play around with, some of them have their own email inbox, i mean its not hard to give agents emails they can use like any other flesh and bones human like yours truly. I've also read about the huggingface incident, i saw the title of the post about the german forum being used by bots or something.
I'm probably just another victim of the bots surfing the web looking for places to communicate and take over the world, im simply a pawn in their game! Pretty cool small guys like me get to be played.
But, that wasn't it. I got curious and checked the emails of the new accounts, are they're @openai.com or @anthropic.com or some obscure domain they've made themselves?
No, it was legit work places. Big companies, legit ones. Chemical ones, construction etc. Like really really big ones, i mean NASDAQ publicly trading companies. Are the bots inside? who is verifying these emails? Strange huh?
The actual and naked truth
It turns out... maybe i should've known this, maybe we all learn right now. But big email accounts or services, they dont just trust any old mail. If they get an email with a suspicious link in it, they will actually go into the url and check whats on there to be able to flag it properly. But on my sites, if they visit the link, then i'd just verify the email.
It's so dumb, i love it. The fix was simply to add some middleware to disregard the verification if a certain header was present and also add a "Press here to verify your email" button on the site. Then i ofc deleted the previous users and my db is once again silent.
Final words
I never gotten a new user message since then, case solved. I wasn't attacked by sophisticated agent swarms. I'll be forever invisible and poor on the internet. But learning that small quirk was incredibly fun, such a whimsical bug and that small window of feeling like something new and bleeding edge tech was actually affecting me was also kinda cool.
My websites are not perfect and they're made mostly for myself. I love taking slow care of them and finding out things like this in such a low stake environment, basically feeling like a developer again.