How to detect fake signups: 7 signals and how to check each one

The 7 signals of a fake signup

1. Disposable (throwaway) email domains

Services such as Mailinator and YOPmail hand out inboxes that work for minutes or hours. Someone who uses one wants your free tier, not a relationship. The check is a set lookup against a list of known throwaway domains. The public-domain disposable-email-domains project is a good start; Vetto ships 9,222 domains from it, and you can search or download them on the disposable email domains list.

// disposable-domains.txt: one domain per line (CC0 list)
import { readFileSync } from 'node:fs';
const LIST = new Set(readFileSync('disposable-domains.txt', 'utf8').split('\n').filter(Boolean));

export function isDisposable(email) {
  const domain = email.split('@').pop().trim().toLowerCase();
  // Check the domain and its parents, so x.mailinator.com matches too.
  const parts = domain.split('.');
  return parts.some((_, i) => LIST.has(parts.slice(i).join('.')));
}

Lists lag behind: new throwaway domains appear every week. A useful second check is the domain's mail server, because many new throwaway domains point their MX records at the same few hosts as the known ones.

2. Dead domains with no mail server

A domain that does not exist, or that cannot receive mail, will never confirm an account. Look it up in DNS: no domain at all (NXDOMAIN), a null MX record that refuses all mail (RFC 7505), or no MX and no A/AAAA fallback (RFC 5321, section 5.1). In Node, dns.promises.resolveMx does the work:

import { promises as dns } from 'node:dns';

// true = the domain can receive mail, false = it cannot.
export async function acceptsMail(domain) {
  try {
    const mx = await dns.resolveMx(domain);
    // Null MX (RFC 7505): a single record with an empty host means "no mail".
    if (mx.length === 1 && (mx[0].exchange === '' || mx[0].exchange === '.')) return false;
    if (mx.length) return true;
  } catch (err) {
    if (err.code === 'ENOTFOUND') return false; // NXDOMAIN: no such domain
    if (err.code !== 'ENODATA') return true;    // timeout etc.: fail open
  }
  // No MX: mail falls back to the A/AAAA record (RFC 5321, implicit MX).
  const [a, aaaa] = await Promise.allSettled([dns.resolve4(domain), dns.resolve6(domain)]);
  return a.status === 'fulfilled' || aaaa.status === 'fulfilled';
}

Note the fail-open branch: if DNS times out, let the signup through. A slow resolver should never cost you a real customer.

3. Typos like gmial.com

Typos are not fake signups, but they look like them in your metrics: the account exists and nobody ever confirms it. One Discourse forum owner reported that almost 10% of new registrants typed their email wrong or left it out (one forum, no method given). Compare the domain against popular providers with an edit distance of one or two and offer a fix, never a block. The email typo checker shows the suggestions Vetto makes.

Watch for lookalike domains that do accept mail, such as gmai.com. They pass the MX check, but your welcome email goes to a stranger. Warn on them.

4. Alias clusters and repeat signups

Gmail ignores dots in the local part (Google), drops anything after a +, and treats googlemail.com as gmail.com. So j.a.n.e+trial7@googlemail.com reaches jane@gmail.com, yet a unique index on the raw string sees two customers. Store a normalized matching key next to each address and check it on signup. The Gmail alias checker groups a pasted list by inbox, and our free trial abuse playbook covers the full fix.

5. Datacenter, VPN and Tor IPs

Real customers browse from home, office and mobile networks. Signup scripts usually run on cloud servers. Look up the IP's autonomous system (ASN): if it belongs to a hosting provider, flag the signup. Many platforms hand you the ASN for free; Cloudflare Workers, for example, expose request.cf.asn and request.cf.asOrganization on every request (Cloudflare docs). Otherwise use an IP-to-ASN database.

A second clue: a browser time zone (Intl.DateTimeFormat().resolvedOptions().timeZone) that does not match the IP's location. Treat both as flags, not blocks. Plenty of privacy-minded customers and corporate staff use VPNs.

6. Signup bursts and velocity

A person signs up once. A script signs up 16 times in an hour from the same IP. Count recent signups per IP (and per network, for scripts that rotate addresses) and act when the count passes a limit you choose:

-- Signups from this IP in the last hour (PostgreSQL)
SELECT count(*) FROM signups
WHERE ip = $1 AND created_at > now() - interval '1 hour';
-- Over your limit (say 5)? Block or challenge the next one.

Keep the limit generous enough for an office or a university behind one shared IP, and alert yourself when it fires: a burst is often the first sign of a targeted attack.

7. Bots caught by a honeypot

Simple bots fill in every field they find. Add one that humans never see, and reject any submission that fills it. Move it off-screen rather than using display:none, which some bots skip, and keep it out of the tab order:

<!-- Humans never see or fill this field. -->
<div style="position:absolute;left:-10000px" aria-hidden="true">
  <label>Leave this empty <input name="website" tabindex="-1" autocomplete="off"></label>
</div>

// Server: reject the signup if req.body.website is not empty.

A honeypot does nothing against bots that post straight to your API and skip the form. For those you need a server-side check, such as a signed token the form adds on submit, or a CAPTCHA.

Turn signals into decisions

Each signal has a different confidence, so each deserves a different response. Blocking a real customer costs more than letting one fake account in.

Tools to detect fake signups in SaaS

You can assemble the checks yourself or buy them. The main options, by category:

• DIY: the snippets on this page. Free and fully under your control, but you maintain the lists, the DNS edge cases and the messages.
• CAPTCHAs and bot challenges such as Cloudflare Turnstile or reCAPTCHA: good against scripts, blind to throwaway inboxes and aliases.
• Email verification APIs such as Kickbox: verify that a mailbox exists over SMTP, built for list hygiene and deliverability. See Vetto vs Kickbox.
• Fraud and device-fingerprinting platforms: deep signals for payments and account takeover, with integration work to match.
• A signup gate like Vetto: the seven signals above behind one script tag.

Before you choose, measure. Export your users and run the free email list audit: it parses the CSV in your browser and tells you how many typos, throwaways, dead domains and alias clusters you already have.

Where Vetto fits

Vetto runs all seven checks on your existing form, with one script tag and no backend code:

<script src="https://usevetto.com/v.js" data-site="pk_your_public_key" defer></script>

• Free (1 site, 1,000 checks a month): one-click typo fixes, throwaway and dead-domain blocking, privacy relays allowed and tagged, and a bot honeypot. The Pro signals run in shadow mode, so your stats show what you would catch.
• Pro ($12/month or $99/year): lookalike domains, alias and repeat-signup detection, datacenter/VPN and burst signals, custom actions per signal, Slack and Discord alerts, and a signed vetto_token your backend checks with POST /v1/verify, so bots that skip the form get caught too.

If Vetto does not answer within 800 ms, the form submits as if it were not installed. What Vetto does not do: SMTP mailbox verification, device fingerprinting or payment fraud scoring. See pricing for the full plan comparison.