Signup abuse, and what we changed.

Automated signups were creating accounts with machine-generated addresses. The addresses passed the old checks because some of them had valid MX records, but they did not belong to real people. The bounces hurt our sending domain and wasted account records.

What we removed

We identified high-confidence fake accounts by domain reputation, machine-generated local parts, and one clear signup cluster. We backed up the records to a private local evidence folder, then removed the accounts, their keys, usage rows and profiles. We did not delete any account with a successful payment.

The heuristic was tightened after review. It no longer flags ordinary names with digits, such as a real Gmail address with a surname and a year. It targets long, digit-heavy, near-vowel-free local parts and the observed cluster.

What now protects signup

• Proof-of-work challenge. The browser solves a SHA-256 challenge before signup. No Cloudflare dependency.
• Live email check. The form checks syntax, MX/A records, disposable domains and machine-generated patterns before submit.
• Honeypot and timing. A hidden field catches naive bots, and a challenge must be solved within its expiry window.
• Automatic source blocks. A fake email, a blocked domain, a honeypot hit, or three failed challenges blocks the IP and device for seven days across the site and API.
• Existing limits. Per-IP, per-domain and per-IP-domain counters still apply.
• No new account without a real address. The account is not created before the email checks pass.

What this means for real users

Signup takes a moment longer while the browser solves the challenge. Use an address you control. If a check is wrong, email [email protected] and we will review it. Login remains protected by the existing lockout; the browser also solves the same challenge.

What is next

We are watching bounce rates and false positives. SMTP mailbox verification is available behind an environment flag because some hosts block port 25. The live checker currently uses DNS, domain reputation and pattern analysis, which is reliable on the networks we run on.