Castle

APIs for account security and anti-abuse

[Castle @Castle_io]

Castle's research team just shared a free dataset of 1063 recent temporary Gmail accounts tied to abuse and fake account creation 👀

Normalized + canonicalized for easier correlation against your own signups.

Is your current anti-fraud stack actually catching this? 🤔

[Antoine Vastel @xopek59]

I heard you like free fraud intel 👀

So here’s a dataset of 1063 recent temporary Gmail accounts observed from a provider used for fake account creation (canonical form).

https://t.co/ECtVxXF0QA

One thing that’s interesting: these services often abuse 2 legit Gmail features:
- dot variations
- plus aliases

Example: [email protected]

becomes:
- https://t.co/[email protected]
- [email protected]
Still the same inbox.

At @Castle_io , we monitor these ecosystems because they regularly show up in signup abuse / account farming campaigns.

Note regarding the dataset: All emails were canonicalized:
- dots removed
- aliases stripped
- gmail/googlemail expanded
-> If you correlate against your own signups, make sure you canonicalize emails on your side too.

[Castle @Castle_io]

Disposable email providers are a core piece of infrastructure behind fake account creation and signup abuse.

Castle’s research team just open sourced a curated list of disposable email domains observed in real abuse activity, updated daily 🔎

https://t.co/PDHOE5fPxT

[Antoine Vastel @xopek59]

@Castle_io 's research team just open sourced a disposable email domain list built from real abuse telemetry 🔎

Disposable email providers are a core piece of infrastructure behind fake account creation and signup abuse, similarly to how proxies enable large-scale traffic distribution.

A few things we cared about:
- curated, not aggregated from public lists
- strictly disposable domains
- updated daily
- ranked by observed abuse prevalence

And yes, before someone says it: attackers also use aged Gmail accounts, compromised inboxes, freshly registered domains, etc 😄

Disposable domains are not the whole problem, but they’re still one of the clearest infrastructure-level signals behind large-scale signup abuse.

Repo:
https://t.co/M7nx959KHE

[Castle @Castle_io]

@thesohom2 @xopek59 Thank you 🤖

[Castle @Castle_io]

Account sharing is a form of account abuse that needs to be detected with more sophistication than just a one-time check during signup or login. Plus, there's no strict rule on how many accounts are okay to share—it's all up to your service's policies. https://t.co/MwtWYm3kCg

[Castle @Castle_io]

We're increasingly seeing how our customers are not just triggering one, but several different CAPTCHAs based on risk and user context.
https://t.co/cEuqutJgCH

[Castle @Castle_io]

Product update: set up Slack alerts to get notified when suspicious behavior is detected, such as account sharing or multi-accounting. https://t.co/bFf9GgASzU

[Castle @Castle_io]

Often our customers find it hard to distinguish between *fraud* and *abuse*. While there are well-defined strategies for preventing fraud, handling abuse often feels like a never-ending game of whack-a-mole, with no one clearly responsible. https://t.co/BKHwujx3iE

[Castle @Castle_io]

Preventing online abuse, such as bots and account sharing, is typically integrated into your existing fraud prevention strategy over time. However, long before then, departments like Eng and Ops take on the responsibility for keeping your service safe. https://t.co/cqlai8JNOD

[Castle @Castle_io]

When measures like email or SMS verification are evaluated from a security perspective, they're often shot down as insecure options. However, when it comes to shutting down fraud and abuse *at scale*, things are a bit more nuanced. https://t.co/1BomTJeAA2

[Castle @Castle_io]

Product update: we just launched the quick explorer in the Castle Dashboard. It allows you to quickly see data associated with any entity, such as all the accounts connected to a specific device or IP. https://t.co/88HDpQRrdn

[Castle @Castle_io]

Device fingerprinting *alone* is a way of stopping fraud, but in reality won't determine fraud alone. In practice, you'll have to build features using the fingerprints, preferably aggregating in *real-time* so that they can actually be used for blocking. https://t.co/Z1sCEUwsjP

[Castle @Castle_io]

As "proxy piercing" has become less effective in 2023 for revealing the true IP address behind a proxy, here are 11 tricks that'll help you predict someone's approximate location while maintaining a good balance of privacy https://t.co/kg5OQBKJsk

[Castle @Castle_io]

Product update: zoom-out button for the selected time range. Quickly zoom back out again after honing in on suspicious traffic spikes. https://t.co/vvCWdEDvus

[Castle @Castle_io]

Device fingerprinting, particularly in the context of fraud prevention, has been getting more attention lately. As a developer, it can be hard to navigate options when vendors put their tech behind paywalls. Here are 9 solutions you can try for free. https://t.co/7FrBiGJbzd

[Castle @Castle_io]

Product update: our APIs now support transaction base amount and granular merchant information, including MCC codes. This comes in handy when monitoring card transactions. https://t.co/ueLGX5ytcx

[Castle @Castle_io]

New feature: Quickly find accounts using the same billing or shipping address. Castle provides a normalized address fingerprint out-of-the-box, but we've added the possibility to use your own. https://t.co/t2jPtQGOB3

[Castle @Castle_io]

New feature: We're released a powerful new way of comparing multiple users' activity over time. Find and block those multi-accounters in an instant! https://t.co/GudrPGoC2R

[Castle @Castle_io]

Super excited to announce instant link analysis that helps you swiftly detect and prevent sophisticated fraud rings with just a few clicks. Unlike legacy solutions, our feature lets you perform link analysis on live data, providing visibility in real-time https://t.co/5Q05vdjTTY

[Castle @Castle_io]

New feature: add custom columns, based on any event field. E.g. min/max/average for numbers and unique value count for strings and enums, as well as the most recent value and top 20 https://t.co/BtR96pcchl

[Castle @Castle_io]

We're excited to introduce the Event Explorer, giving security & fraud teams a new way to discover and investigate malicious activity. The new view allows you to browse & query Castle events, making it much faster to investigate & find patterns of fraud. https://t.co/J2SLw2NJZc