The questions web3 teams actually ask about automated abuse - answered directly, with the mechanics that matter.
You blocked disposable emails last month. The fake accounts are back, and they are using domains your blocklist has never seen.
A CAPTCHA stops the bots that cannot solve it. It does not stop the bots that can, and the bots that can are the ones that cost the most, because they are the ones built to look human.
The form has no CAPTCHA, no puzzle, and no friction, and the spam stopped anyway. The trap is a field humans never see, and a clock humans never notice, and both of them are free.
The code arrived by text, the user typed it in, and the account was gone anyway. The attacker never saw the phone. They ran a bot that asked the user for the code, and the user handed it over.
Your signup form is getting hit from 10 million devices, and your fraud tool says they are all real phones. They are real phones. That is the problem, and it is a different problem from the botnet you were looking for.
You replaced passwords with passkeys and the fake signups did not stop. The passkeys work exactly as designed, and the bot problem they solve is not the bot problem you have.
A device fingerprint can link five fake accounts to one phone. It can also link your household's three real accounts to one laptop and flag all of them. The difference is how the score is used.
By the time a fake account makes its first purchase, the fraud has already happened. The signup form is where it should have been caught, and behavior is the signal that catches it.
Fifty accounts in an hour is not a marketing win. It is a farm, and the signup log shows it before the first fake order arrives.
Every fake account starts with an email and a phone number that look real and are not. The toolkit is cheap, the signals are visible, and the checks are too.
Akamai counted 26 billion credential-stuffing attempts a month in 2024. The attacks succeed 0.1 to 2 percent of the time, and at that volume the fraction is the whole business model.
SMS codes are the verification method everyone uses and the one attackers abuse most. Authenticator apps are stronger, passkeys are stronger still, and the right choice depends on who your users are, not on what is newest.
A fake signup passes the form. It fails the pattern: disposable email, a device behind forty other accounts, a form filled faster than a person can type, and behaviour after signup that goes straight for the valuable thing.
The street address matches, the city matches, and the delivery still fails, because the unit number was dropped, merged, or never validated. Secondary address data is the weakest field in most checkout validation.
Blocking known disposable domains stops the laziest signup abuse and waves through anyone with a custom domain or a Gmail dot trick. Where the check earns its place, and where it is theater.
Attackers request one time codes to premium numbers they control a cut of, thousands of times, and the victim pays the phone bill. The controls live in geography, velocity, and number type checks.
Syntax, domain, mailbox. A form that checks only the shape of an address collects perfectly formatted mailboxes that do not exist, and pays for the bounces later.
The first six to eight digits of a card number identify the issuer, the network, the card type, and the country. Checkout validation that reads the BIN catches errors and fraud signals before the gateway does.
Token faucets exist to onboard real users, but bot farms drain them at industrial scale. How faucet farming works, why it poisons airdrop eligibility data, and the defenses that keep faucets flowing to humans.
One person, one vote requires knowing who is a person, which collides with crypto's privacy ethos. How DAOs are navigating the proof-of-personhood tradeoff.
Sybil attacks flood DAO governance with fake wallets to swing votes. How attackers build wallet farms, how on-chain behavior betrays them, and what vote designs resist manipulation.
Airdrop farmers run thousands of wallets through scripted onchain activity to harvest token distributions meant for real users. How wallet farms operate, how sybil detection catches them, and what honest projects do about it.
Sybil wallets have to interact, and the interaction pattern forms a graph that looks nothing like real users. How funding chains and behavioral clustering reveal the operation behind the wallets.
Protocols want one-human-one-account without centralized KYC. How proof-of-humanity systems work, where they break, and what sybil resistance really costs.
One farmer with a thousand wallets can drain an airdrop. How sybil scoring combines onchain and behavioral signals to protect token distributions.
Points programs turn pre-TGE engagement into a farmable asset, and bot operators farm them industrially. How sybil networks game points, restaking, and leaderboard mechanics before launch.
You verify every signup by email. The fake accounts keep coming. The verification is working. It is just verifying the wrong thing.
A CAPTCHA stops the bots that cannot solve it. It does not stop the bots that can, and the bots that can are the ones that cost the most, because they are the ones built to look human.
The form has no CAPTCHA, no puzzle, and no friction, and the spam stopped anyway. The trap is a field humans never see, and a clock humans never notice, and both of them are free.
The code arrived by text, the user typed it in, and the account was gone anyway. The attacker never saw the phone. They ran a bot that asked the user for the code, and the user handed it over.
Your signup form is getting hit from 10 million devices, and your fraud tool says they are all real phones. They are real phones. That is the problem, and it is a different problem from the botnet you were looking for.
You replaced passwords with passkeys and the fake signups did not stop. The passkeys work exactly as designed, and the bot problem they solve is not the bot problem you have.
A device fingerprint can link five fake accounts to one phone. It can also link your household's three real accounts to one laptop and flag all of them. The difference is how the score is used.
By the time a fake account makes its first purchase, the fraud has already happened. The signup form is where it should have been caught, and behavior is the signal that catches it.
Fifty accounts in an hour is not a marketing win. It is a farm, and the signup log shows it before the first fake order arrives.
Every fake account starts with an email and a phone number that look real and are not. The toolkit is cheap, the signals are visible, and the checks are too.
Akamai counted 26 billion credential-stuffing attempts a month in 2024. The attacks succeed 0.1 to 2 percent of the time, and at that volume the fraction is the whole business model.
SMS codes are the verification method everyone uses and the one attackers abuse most. Authenticator apps are stronger, passkeys are stronger still, and the right choice depends on who your users are, not on what is newest.
A fake signup passes the form. It fails the pattern: disposable email, a device behind forty other accounts, a form filled faster than a person can type, and behaviour after signup that goes straight for the valuable thing.
The street address matches, the city matches, and the delivery still fails, because the unit number was dropped, merged, or never validated. Secondary address data is the weakest field in most checkout validation.
Blocking known disposable domains stops the laziest signup abuse and waves through anyone with a custom domain or a Gmail dot trick. Where the check earns its place, and where it is theater.
Attackers request one time codes to premium numbers they control a cut of, thousands of times, and the victim pays the phone bill. The controls live in geography, velocity, and number type checks.
Syntax, domain, mailbox. A form that checks only the shape of an address collects perfectly formatted mailboxes that do not exist, and pays for the bounces later.
The first six to eight digits of a card number identify the issuer, the network, the card type, and the country. Checkout validation that reads the BIN catches errors and fraud signals before the gateway does.
Token faucets exist to onboard real users, but bot farms drain them at industrial scale. How faucet farming works, why it poisons airdrop eligibility data, and the defenses that keep faucets flowing to humans.
One person, one vote requires knowing who is a person, which collides with crypto's privacy ethos. How DAOs are navigating the proof-of-personhood tradeoff.
Sybil attacks flood DAO governance with fake wallets to swing votes. How attackers build wallet farms, how on-chain behavior betrays them, and what vote designs resist manipulation.
Airdrop farmers run thousands of wallets through scripted onchain activity to harvest token distributions meant for real users. How wallet farms operate, how sybil detection catches them, and what honest projects do about it.
Sybil wallets have to interact, and the interaction pattern forms a graph that looks nothing like real users. How funding chains and behavioral clustering reveal the operation behind the wallets.
Protocols want one-human-one-account without centralized KYC. How proof-of-humanity systems work, where they break, and what sybil resistance really costs.
One farmer with a thousand wallets can drain an airdrop. How sybil scoring combines onchain and behavioral signals to protect token distributions.
Points programs turn pre-TGE engagement into a farmable asset, and bot operators farm them industrially. How sybil networks game points, restaking, and leaderboard mechanics before launch.
Every signup form faces the same trade: verify the email and lose some real users, or skip verification and let the fake accounts in. The right answer is not one or the other. It is a verification step that costs the real user nothing and stops the fake one cold.
A CAPTCHA stops the bots that cannot solve it. It does not stop the bots that can, and the bots that can are the ones that cost the most, because they are the ones built to look human.
The form has no CAPTCHA, no puzzle, and no friction, and the spam stopped anyway. The trap is a field humans never see, and a clock humans never notice, and both of them are free.
The code arrived by text, the user typed it in, and the account was gone anyway. The attacker never saw the phone. They ran a bot that asked the user for the code, and the user handed it over.
Your signup form is getting hit from 10 million devices, and your fraud tool says they are all real phones. They are real phones. That is the problem, and it is a different problem from the botnet you were looking for.
You replaced passwords with passkeys and the fake signups did not stop. The passkeys work exactly as designed, and the bot problem they solve is not the bot problem you have.
A device fingerprint can link five fake accounts to one phone. It can also link your household's three real accounts to one laptop and flag all of them. The difference is how the score is used.
By the time a fake account makes its first purchase, the fraud has already happened. The signup form is where it should have been caught, and behavior is the signal that catches it.
Fifty accounts in an hour is not a marketing win. It is a farm, and the signup log shows it before the first fake order arrives.
Every fake account starts with an email and a phone number that look real and are not. The toolkit is cheap, the signals are visible, and the checks are too.
Akamai counted 26 billion credential-stuffing attempts a month in 2024. The attacks succeed 0.1 to 2 percent of the time, and at that volume the fraction is the whole business model.
SMS codes are the verification method everyone uses and the one attackers abuse most. Authenticator apps are stronger, passkeys are stronger still, and the right choice depends on who your users are, not on what is newest.
A fake signup passes the form. It fails the pattern: disposable email, a device behind forty other accounts, a form filled faster than a person can type, and behaviour after signup that goes straight for the valuable thing.
The street address matches, the city matches, and the delivery still fails, because the unit number was dropped, merged, or never validated. Secondary address data is the weakest field in most checkout validation.
Blocking known disposable domains stops the laziest signup abuse and waves through anyone with a custom domain or a Gmail dot trick. Where the check earns its place, and where it is theater.
Attackers request one time codes to premium numbers they control a cut of, thousands of times, and the victim pays the phone bill. The controls live in geography, velocity, and number type checks.
Syntax, domain, mailbox. A form that checks only the shape of an address collects perfectly formatted mailboxes that do not exist, and pays for the bounces later.
The first six to eight digits of a card number identify the issuer, the network, the card type, and the country. Checkout validation that reads the BIN catches errors and fraud signals before the gateway does.
Token faucets exist to onboard real users, but bot farms drain them at industrial scale. How faucet farming works, why it poisons airdrop eligibility data, and the defenses that keep faucets flowing to humans.
One person, one vote requires knowing who is a person, which collides with crypto's privacy ethos. How DAOs are navigating the proof-of-personhood tradeoff.
Sybil attacks flood DAO governance with fake wallets to swing votes. How attackers build wallet farms, how on-chain behavior betrays them, and what vote designs resist manipulation.
Airdrop farmers run thousands of wallets through scripted onchain activity to harvest token distributions meant for real users. How wallet farms operate, how sybil detection catches them, and what honest projects do about it.
Sybil wallets have to interact, and the interaction pattern forms a graph that looks nothing like real users. How funding chains and behavioral clustering reveal the operation behind the wallets.
Protocols want one-human-one-account without centralized KYC. How proof-of-humanity systems work, where they break, and what sybil resistance really costs.
One farmer with a thousand wallets can drain an airdrop. How sybil scoring combines onchain and behavioral signals to protect token distributions.
Points programs turn pre-TGE engagement into a farmable asset, and bot operators farm them industrially. How sybil networks game points, restaking, and leaderboard mechanics before launch.
Get a free bot-traffic audit. We sample your live traffic and show the human-automated split, endpoint by endpoint.
Get a free bot-traffic audit