Stop fake signups before they cost you anything
Score a signup's phone, email and IP in one pass — disposable mailboxes, VPN and proxy exits, forged source addresses and known-bad domains, each named rather than folded into a mystery score.
Trial abuse looks like growth until you pay for it: bot accounts burning free credits, stolen-card signups, one person with forty disposable mailboxes. By the time the chargeback or the abuse report arrives, the cost is real.
The signals that catch this are boring and public — the mailbox is disposable, the IP is a VPN exit or unrouted address space, the domain was registered for phishing. What matters is checking all of them in one call, at signup time, fast enough that a legitimate user never notices.
The endpoints, and what each costs
POST /api/fraud-score
{ "email": "[email protected]", "ip": "185.220.101.4", "phone": "+14155550123" }{
"risk": 87,
"signals": {
"email": { "disposable": true },
"ip": { "tor": true, "blacklists": ["dan.me.uk"] },
"phone": { "valid": true }
},
"receipt": { "resultSha256": "…", "signature": "…" }
}Every signal is named. A bare score cannot be argued with, audited, or tuned — the reasons can.
The part a use-case page usually skips
A risk score is a signal, not a verdict
87/100 means several independent signals agree, not that this human is a criminal. Block at a threshold you chose, review the band below it, and keep the receipt so you can revisit the decision later.
We see the request, not the person
A patient fraudster on a residential IP with a real mailbox scores clean. These checks raise the cost of casual abuse; they do not replace payment-provider risk tools for card fraud.
What makes the bogon signal different from a blacklist hit?
A blacklist entry is somebody's report about behaviour, and it ages. A bogon is unallocated or reserved address space — a request claiming to come from one is forged by definition. We keep the two apart so a definitional fact never inherits a reputation feed's error rate.
Will this block my real users on VPNs?
Only if you tell it to. The response says 'VPN detected' and leaves the policy to you — plenty of legitimate users run VPNs, which is exactly why we return the signal instead of a block/allow verdict.