Ahmed Saleh
2026/07/23
One device, 400 fake accounts: the six signals that gave the ring away
Every week I take one real fraud or abuse case, walk through what the actor actually did, and list the rules you can add to your own trust engine because of it. This is edition #001.
This one is about 400 fake accounts, one operator, and the free email trick that almost made them look legitimate.
The case
About 400 fake accounts on a platform we protect, created over 30 days, all traced back to a single operator.
None of this was sophisticated. I'm writing it up because every check below is cheap, and this operation still walked past all of them for a month.
The evidence, one signal at a time
1. 400 accounts, one device
Every single account was created from one device fingerprint.
accounts_seen : 400
fingerprints : 1
verdict : same operator
That's the whole finding. Not "similar" devices, not a cluster. One.
2. One IP, already burned
All 400 signups came from a single IP address, and that address was already flagged in our abuse database before this case opened.
source_ips : 1
abuse_reputation : LISTED
first_flagged : before this case
The operator never rotated. They didn't need to, because nothing on the platform was checking.
3. Every email had the same shape
One domain, and every local part built the same way: five characters, a dot, five more characters.
qkrtv.mmzpe@urandom.io
xhwad.pqlsn@urandom.io
bfjyo.ztrqe@urandom.io
... x 400 pattern: xxxxx.yyyyy@
A human picking email addresses doesn't produce that. A generator does.
4. The domain looked legitimate, its mail servers did not
This is the signal I'd add first, and the one a better funded actor still tends to trip over.
urandom.io is a real custom domain. It resolves, it has a website, and to a blocklist built on known disposable providers it looks like an ordinary company domain. The MX records tell a different story:
mx : urandom.io
10 mx1.forwardemail.net 121.127.44.56 Datacamp Ltd AS60068
10 mx2.forwardemail.net 104.248.224.170 DigitalOcean AS14061
The domain doesn't run its own mail. It forwards through a free service. Real companies almost never do that, and disposable-address operations almost always do, because running actual mail infrastructure costs money and attention.
5. No human ever showed up
All 400 sessions tripped bot detection at maximum confidence.
sessions_scored : 400 / 400
bot_confidence : MAXIMUM
human_sessions : 0
Not a mixed population with some automation in it. Zero human sessions across the whole set.
Rules worth adding to your engine
All six of these live at signup or onboarding, and any one of them is a flag on its own. This actor tripped all six.
- Same device fingerprint across many signups. Flag it when a lot of new accounts share one device. Then set a hard ceiling: a maximum number of new accounts per fingerprint.
- Signup IP listed in abuse reputation databases. Check the IP at signup and fold the result into a risk score rather than a hard block.
- Patterned email local parts on one domain. Machine-generated local parts have a shape. Match on it.
- Signup velocity per email domain. Rate limit new accounts per email domain, not only per IP.
- MX records pointing at a free forwarding service. Look the domain up at signup. A custom domain forwarding through a free service should raise the risk score, not clear it.
- Max-confidence bot score at registration. Treat this as a hard signal, not a soft one.
A step worth adding before the fingerprint ceiling: require a phone number and cap the number of accounts per number. It costs the actor real money, and that's usually where these operations stop being worth running.
One warning before you ship these
Signup rules stop this actor. They don't stop the next one.
The next actor pays a real human to pass onboarding cleanly, then hands the account over to a bot. Everything they show you at the front door is genuine, because a person was genuinely sitting there. If your checks all live at registration, that account is now invisible to you for the rest of its life.
So watch the actions that matter, continuously, and not only at the door. It's more work than a signup rule, and it's the part that still works next month.
See this on your own traffic
Every signal in this write-up ships with Rupt. Book a demo and we will show you what is already happening inside your product.
Book a demo →Get the next case in your inbox
Trust Booster is one real fraud or abuse case a week, with the rules to catch it. Free, and it works whether or not you use Rupt.
Subscribe to Trust Booster →