Stop fake signups before they use your free credits
One API call at signup checks the email, IP address and phone number, collapses Gmail dots and +tags to one inbox, and counts repeat signups from the last hour. You get allow, review or block, a risk score and the reasons in plain words, for 5 credits a check.
janedoe+promo6@example.com
203.0.113.24
- 6 other signups in the last hour used spellings of this same inbox
- The IP address belongs to a hosting or cloud provider, not a home or phone network
- The email domain was registered 3 days ago
email_rootjanedoe@example.com
email_is_aliastrue
14
signups from this IP in the last hour
6
signups from this inbox in the last hour
38
Allowed
4
To review
11
Blocked
Every signup, as it happens
5
Credits per signup check
about $0.025 on Starter
5
Checks in one call
address, domain, IP, phone and burst
60 min
Window for repeat signups
counted for each API key
3
Verdicts you can act on
allow, review or block
Every signup passes five checks and comes out as allow, review or block
The email, IP address and phone number go in, five checks run in one call, and the risk score decides the verdict.
Signup
- emailjanedoe+promo6@example.com
- ip (optional)203.0.113.24
- phone (optional)+1 415 555 0142
Address
Gmail dots and +tags to one inbox
Domain
Disposable, new or no mail servers
IP address
Data center, VPN, proxy, Tor, blocklists
Phone
Invalid, VoIP and virtual numbers
Burst
Repeat signups in the last 60 minutes
0 to 100 risk score
Allow
Let them straight in
Review
Ask for one more proof
Block
Refuse the signup
Pricing
A signup check costs 5 credits, and a bigger plan lowers the price of every check
Starter
$99/month
4,000
signup checks a month
2.5¢ a check
Growth
$299/month
17,000
signup checks a month
1.8¢ a check
Professional
$799/month
50,000
signup checks a month
1.6¢ a check
Enterprise
Lowest per check$1,999/month
200,000
signup checks a month
1.0¢ a check
Five checks run in one call, and every verdict comes with its reasons
Gmail dots and +tags collapse to one inbox
A person who signs up with a dozen +tags or dotted copies of one Gmail address still reaches a single inbox. The check reduces every address to its root, so the dozen signups are counted as one.
- email_root returned on every check
- An email_is_alias flag when the address is a copy
- Repeats counted against the root inbox
- Plain reasons that name the alias
Throwaway and brand-new domains are caught at the door
Disposable inbox domains, domains registered in the last few days and domains with no mail servers are flagged, because none of them belongs to a customer you want to give credits to.
- Disposable domains
- Newly registered domains
- No-MX domains that cannot receive mail
- Domain age in the reasons
Data center, VPN, proxy and Tor addresses are flagged
Send the IP address the signup came from and the check says whether it belongs to a data center, a VPN, a proxy or the Tor network, or sits on a public blocklist.
- Data center addresses
- VPN and proxy addresses
- Tor exit addresses
- IPs on public blocklists
Phone numbers are checked when you collect them
A signup that gives a phone number gets it checked too: an invalid number, or a VoIP or virtual number that anyone can create in seconds, adds to the risk score.
- Invalid numbers
- VoIP and virtual numbers
- Optional on every call
- A phone from another country than the IP address
A one-hour burst check counts repeat signups
For every check, it counts how many different signups on your API key in the last hour share an IP address, an inbox or an email domain, so a burst from one source stands out.
- A 60-minute window
- Counted for each API key
- IP address, inbox and email domain
- Counts returned in the response
Every verdict comes with reasons in plain words
A block is never a mystery. The reasons list says what the check saw, in sentences your support team can read to a customer who writes in.
- allow, review or block
- A 0 to 100 risk score
- A list of reasons in plain words
- The same fields on every response
A signup goes in and a verdict with its reasons comes out
Send the signup
POST the email address from your signup form. Add the IP address the request came from and the phone number if you collect one, and each one runs another check.
$ POST /api/v1/signup-check
"email": "janedoe+promo6@example.com"
"ip": "203.0.113.24"
> phone is optional too
Five checks run at once
The address is reduced to its root inbox, the domain is checked, the IP address and phone number are checked, and the last hour of signups on your API key is counted.
Address reduced to its root inbox
Domain: age, disposable, mail servers
IP address: data center, VPN, blocklists
Repeat signups in the last 60 minutes
Act on allow, review or block
You get the verdict, a 0 to 100 risk score and the reasons in plain words, in one JSON payload. Every check bills 5 credits.
verdictblock
risk_score92
email_rootjanedoe@example.com
One endpoint scores a signup and works like every other 1Lookup call
Same authentication, same credit balance, and the same response envelope as every other 1Lookup product. If you have already integrated one endpoint, this one is a URL change.
curl -X POST https://app.1lookup.io/api/v1/signup-check \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{
"email": "janedoe+promo6@example.com",
"ip": "203.0.113.24",
"phone": "+1 415 555 0142"
}'{
"success": true,
"data": {
"classification": {
"verdict": "block",
"risk_score": 92,
"reason_count": 3,
"top_reason": "6 other signups in the last hour used spellings of this same inbox.",
"email_root": "janedoe@example.com",
"email_is_alias": true,
"signups_same_ip_1h": 14,
"signups_same_inbox_1h": 6
},
"insights": {
"signup_check_result": {
"reasons": [
{ "text": "6 other signups in the last hour used spellings of this same inbox." },
{ "text": "The IP address belongs to a hosting or cloud provider, not a home or phone network." },
{ "text": "The email domain was registered 3 days ago." }
],
"burst": {
"window_seconds": 3600,
"other_signups_same_ip": 14,
"other_signups_same_inbox": 6,
"other_signups_same_domain": 3
}
}
},
"metadata": { "credits_used": 5 }
}
}A blocked signup comes back with its score and every reason in plain words
This is the answer for the sample signup: a +tag copy of an inbox that signed up 6 times this hour, from a data center address, on a brand-new domain.
Signup in
Why it was blocked
- 6 other signups in the last hour used spellings of this same inbox.
- The IP address belongs to a hosting or cloud provider, not a home or phone network.
- The email domain was registered 3 days ago.
- Email root
- janedoe@example.com
- Alias of that inbox
- yes
- Same IP, 1 hour
- 14 signups
- Same inbox, 1 hour
- 6 signups
A burst of 14 signups from one IP address in an hour stands out at once
Every check counts the last 60 minutes of signups on your API key. This is one IP address over the last 12 hours.
14
signups from this IP in the last 60 minutes
6
signups sharing one email root in the same hour
1
signup in a typical hour from this IP
Every signup check returns the same fields at one flat price
A count that does not apply to a signup comes back as null. Every check costs the same 5 credits.
These fields hold the verdict and the root inbox.
- classification.verdict
- classification.risk_score
- classification.top_reason
- classification.email_root
- classification.email_is_alias
These fields hold the one-hour counts, under insights.signup_check_result.burst.
- window_seconds
- other_signups_same_ip
- other_signups_same_inbox
- other_signups_same_domain
These fields hold the bill.
- success
- metadata.credits_used
Teams that give away free credits use it to keep fake accounts out
AI products that give away free credits
Check every signup before it gets its free credits, so a script that creates a hundred accounts for the free tier is refused at the first one.
SaaS apps with a free trial or a free plan
Send review signups to an extra check of your own and let allow signups straight in, so real people never feel the friction.
Referral and promo programs
Collapse +tags and dots to one inbox so one person cannot claim a signup bonus or a referral reward again and again.
Developer tools that issue an API key at signup
Hold the key for a signup that comes from a data center with a throwaway domain, and issue it at once to one that does not.
Communities and marketplaces
Keep spam accounts and sock puppets out at registration, and give your moderators the reasons so they can see why a signup was held.
Growth teams cleaning an existing user list
Run last month's signups through a bulk file, find the clusters that share an inbox, an IP address or a phone number, and close the accounts that were never real.
Four signups that look different all collapse to one inbox
The check reduces every address to its root, so one inbox cannot become a hundred accounts.
Four signups · Sample data
- 1janedoe+trial1@example.com
- 2janedoe+trial2@example.com
- 3janedoe+promo@example.com
- 4jane.doe@example.com
One root inbox
janedoe@example.com
- +tags removed
- Gmail dots ignored
- Every copy counted against the same root
These are the questions people ask before they add it to a signup form
What does the Signup Check API return?
Send a signup's email address, and its IP address and phone number if you have them, and it returns a verdict (allow, review or block), a 0 to 100 risk score and a list of the reasons in plain words. It also returns the address's root inbox, with a flag for whether the address is an alias of it, and a count of how many other signups in the last hour share its IP address, its inbox or its email domain.
Why is it not just email verification?
Email verification tells you whether an address can receive mail. It does not see that six signups in the last hour are the same inbox with different +tags, that they all came from one data center, or that the domain was registered three days ago. Signup Check looks at the email, the IP address and the phone number together, and counts repeats over the last hour, so it answers the question that matters at signup: is this account worth your free credits?
What does it check?
Five things in one call. The address: Gmail dots and +tags collapse to one root inbox. The domain: disposable domains, newly registered domains and domains with no MX records, which cannot receive mail. The IP address: data center, VPN, proxy and Tor addresses, and IPs on public blocklists. The phone number: invalid numbers and VoIP or virtual numbers. And the one-hour burst check, which counts repeat signups.
How does the one-hour burst check work?
For every check, it counts how many different signups your API key sent in the last 60 minutes that share the same IP address, the same inbox or the same email domain. The counts come back in the response (insights.signup_check_result.burst), and they feed the verdict, so ten signups from one IP address in an hour read very differently from one. A count that does not apply to a signup comes back as null.
What do allow, review and block mean?
Allow means the signup looks like a real person and can go straight in. Review means it is worth a second look: hold the free credits, ask for more proof, or send it to a person. Block means the signals add up to an abuse attempt and the signup can be refused. You decide what each verdict does in your own app, and the reasons list tells you why the check chose it.
Which fields do I have to send?
Only the email address. The IP address and the phone number are optional, and every one you add runs one more check: with an IP address you get the data center, VPN, proxy, Tor and blocklist checks, and with a phone number you get the invalid and VoIP checks.
How much does a signup check cost?
5 credits per check, about $0.025 on the Starter plan. The price is the same whether you send an email alone or an email, an IP address and a phone number, and the credits are the same ones that pay for every other 1Lookup product.
Can I check a whole file of signups?
Yes. Upload a file with one signup per row, an email address and optionally an IP address and a phone number, in the dashboard or send it as a bulk job, and every row comes back with a verdict, a risk score and its reasons. The price stays at the same credits per check.
Does it replace my email confirmation step?
No, and you do not have to choose. A confirmation email proves the person can open the inbox. Signup Check decides whether the signup is worth accepting before you spend anything on it, and it catches the case a confirmation cannot: one person confirming ten inboxes they control.
Where do I call it?
On your server, at the point where a signup is created and before you hand out credits, a trial or an API key. Send the email, the IP address the request came from and the phone number if you collect one, then act on the verdict.
Is there a charge for extra team members?
No. Your whole team can use one account, and there is no fee per seat.
Do unused credits expire?
Unused subscription credits roll over for up to 3 months, and they can be spent on any 1Lookup product.
A verdict is one view of a signup, and these products go deeper on each part of it
Here is how checking a signup with 1Lookup compares with the other ways to stop fake signups.
Each page sets a rival's plans and prices beside ours and says where the rival does the job better. Every figure carries its source and the date it was checked.