Every user gets labeled real, suspicious, or agency/spam based on five signals. This page shows the logic, the current numbers, and lets you sample users in each bucket.
Showing all users.
Current state
"Real" breakdown — how did they get here?
Loading…
Validation — do labels predict who pays?
If the model is meaningful, real users should pay at higher rates than agency/spam.
The five signals
Each signal adds points to a 0-100 score. Signals are additive but the score is capped at 100.
Suspicious email domain
+50–70
Domain is on our blocklist of agency aliases (
burst-email.com, brite-mail.com, etc.),
SEO/citation tools (plumcitations.com, businessmailsystem.com), or classic disposable
services (yopmail.com, mailinator.com).
Points: agency_alias +50 · seo_tool +60 · disposable +70
Shared signup IP
+5–35
Many distinct user accounts originate from the same IP at signup. Real signups almost always come from
unique residential or mobile IPs. Bulk signups from a single IP are agency operations or bots.
Points: ≥100 users +35 · 20-99 +25 · 5-19 +15 · 2-4 +5
Generic display name
+15
Display name matches a templated placeholder:
Business Manager, Front Desk,
Owner, Admin, Marketing, Sales, Office, etc.
Real owners almost always type their real name.
Gibberish display name
+25
Display name is 8-12 lowercase letters with no spaces or digits (e.g.,
ywlxoxvqcq).
Pattern observed in known bot signup campaigns (Feb-Mar 2025).
Agency keyword in email prefix
+15
Email prefix contains
citation, listing, seo, marketing,
directory, optim, or starts with submi. Strong signal of an agency
operating the account.
Multi-business admin
+8–25
User is admin of multiple distinct business profiles. Legit owners typically manage 1 (sometimes 2-3 for
franchises or multi-location operators). Anything 5+ is usually an agency.
Points: ≥10 +25 · 5-9 +15 · 3-4 +8
Scoring formula
score = clamp_to_100(
domain_points // 0, 50, 60, or 70
+ ip_points // 0, 5, 15, 25, or 35
+ generic_name // 0 or 15
+ gibberish_name // 0 or 25
+ agency_prefix // 0 or 15
+ multi_business // 0, 8, 15, or 25
)
label =
agency_or_spam if (suspicious_domain ≠ NULL)
OR (users_on_ip ≥ 5 AND is_generic_name)
OR (is_gibberish_name)
OR (users_on_ip ≥ 100)
suspicious if (users_on_ip ≥ 5)
OR (is_generic_name)
OR (prefix_agency)
OR (business_count ≥ 5)
real otherwise
Top flagged email domains
Domains currently on the blocklist, ranked by user count.
Domains worth reviewing (not yet flagged)
Non-mainstream domains with 100+ users that aren't currently flagged. New agency tooling rotates domains — these are candidates to add.
Top signup IPs
IPs that account for the most signups. Single IPs creating thousands of accounts are agencies, server farms, or VPN exit nodes.