I mean I run a SaaS and get many fake registered users / bots.
What I did for now is:
- Added a honeypot field (invisible to users, but bots might fill it) -> if it's filled, instant reject
- Added a check for spammy domains -> if it's from such a domain, instant reject
Honeypots may be skipped by bots. My simple solution to this is to create an input/text field in the account creation form, add a placeholder text "I am human" and ask the user to enter what they see (i.e., placeholder text). I've never received any fake/spam account since I incorporated this technique.
This is smart. Are there scenarios you've noticed that it doesn't work?
I've just added it :D
But I would guess that there will be new domains that I don't have in my blocklist and then I need to add them again and I would like to have this as a crowdsourced effort.