IPScanner

Signup Gate

Stop fake signups before they become accounts

One script tag on your signup form, one check on your server. Bots, throwaway inboxes, dead domains and Tor or VPN signups get caught. Typos like gmial.com get a fix.

Protect your signup formSee the check
  • No puzzle
  • Checks the email
  • Monitor mode first

What it checks

Three checks on every signup

The network and the browser come with the token. The email comes with your server's verify call.

  • Network

    Tor, VPN, residential proxy and hosting addresses, named by class.

  • Browser

    Headless browsers and scripted clients that fill in forms for bots.

  • Email

    Bad syntax, domains that take no mail, throwaway inboxes, typos and role addresses.

How it works

Four steps, nothing for your visitors to do

The same Form Gate you would put on any form, with the address added to the check.

  1. 1

    Add the gate.js tag

    One script tag on your signup page, with your site key.

    signup.html
    <script
  src="https://ipscanner.io/gate.js"
  data-sitekey="site_4fQ8nZ2kLm7xR1vT9cBw"
  async></script>
  2. 2

    The form carries a token

    gate.js adds a hidden ipscanner-token field. No cookies, no browser storage.

    signup.html
    <form method="post" action="/signup">
  <input name="email" type="email">
  <input name="password" type="password">
  <!-- added by gate.js -->
  <input type="hidden"
    name="ipscanner-token"
    value="c2l0ZV80ZlE4fDE3…">
</form>
  3. 3

    Verify with the email

    Your server sends the token and the address to /v1/gate/verify and gets one answer back.

    POST /v1/gate/verify
    {
  "success": true,
  "class": "human",
  "action": "flag",
  "mode": "enforce",
  "email": {
    "status": "risky",
    "reason": "typo",
    "suggestion": "jane@gmail.com",
    "domain": "gmial.com",
    "action": "flag"
  }
}
  4. 4

    Decide per outcome

    Throwaway and invalid addresses are blocked by default. Typos are flagged, so you can offer the fix.

    • Invalid addressAllowFlagBlock
    • Throwaway inboxAllowFlagBlock
    • Likely typoAllowFlagBlock
    • Role addressAllowFlagBlock

The check

About ten lines on your server

Send email with the token. Refuse the signup when action is block in enforce mode, and show email.suggestion when there is one.

verify.mjs
// token = the form's "ipscanner-token" field, ip = the visitor's address
// email = the address the form submitted
const res = await fetch('https://ipscanner.io/v1/gate/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ secret: process.env.IPSCANNER_GATE_SECRET, token, remote_ip: ip, email })
});
const v = await res.json();
if (!v.success || (v.action === 'block' && v.mode === 'enforce')) {
  // reject the signup; v.email.suggestion holds "did you mean" when there is one
}
Protect your signup formRead the gate docs

Monitor first, then block

See every signup it would stop

In monitor mode nothing is refused. The Sites dashboard shows each signup with its class, its email outcome and what would have happened.

  • Monitor for free: 30,000 checks a month and a 7-day log
  • Enforce from Starter, $19/mo
  • One request per signup checked with its email
  • Change any action without a redeploy
Signup form · example.comMonitorEnforce
  • 14:02Human · Throwaway inboxWould block
  • 14:01HumanAllow
  • 13:58Malicious automationWould block
  • 13:57Human · Likely typoFlag
  • 13:55VPN · Invalid addressWould block

FAQ

Questions

The syntax, whether the domain receives mail (its MX records), throwaway inbox providers, typos of big webmail domains such as gmial.com, and role addresses like info@.

Protect your signup form

Create a gate with signup emails on, paste one script tag, add the check. Free runs in monitor mode; Starter blocks, from $19/mo.

Protect your signup formRead the gate docs

Not a signup form? Form Gate works on any form