Detect Signup Bots
A bot hits your signup form, invents a name, and creates a fake account before a real person would have found the submit button. It happens hundreds of times a day from different IPs, different user agents, and different email addresses, not one of them a customer, while the proprietor of this enterprise sleeps soundly through the entire performance.
Dregs scores every new registration as it lands: genuine prospects pass without friction, and the automated signups are flagged before they settle into your user table.
What Are Signup Bots?
Signup bots are automated scripts that submit a SaaS registration form to create fake accounts at scale. They typically rotate email addresses, IP addresses, and user agents so each registration looks like a new visitor. The accounts are stockpiled for spam, trial harvest, or later campaigns. The pattern is registration bot abuse: the signup form is the target, not the login page.
The crude ones announce themselves in the user agent. The ones that do real damage are better turned out — headless browsers that render JavaScript, rotate IPs, and imitate a human well enough to get through the door. Off-the-shelf headless browser frameworks are free and thoroughly documented. CAPTCHA-solving services cost pennies. Residential proxy networks have reduced IP-based detection to decoration.
The conventional defenses aren't keeping up, and they were built for a different problem.
| The Traditional Defense | Why It Often Fails |
|---|---|
| CAPTCHAs | Solver farms clear them for a fraction of a cent while your customers squint at traffic lights. The bots pay a rounding error; the humans pay in patience. |
| Rate limiting | Distributed networks spread registrations over thousands of IPs, each one sitting politely under every threshold. Volume caps catch the clumsy operations and merely inconvenience the rest. |
| Email verification | Disposable providers hand out verified inboxes that live exactly long enough to click the confirmation link. Proving the address exists proves nothing about whether a person submitted the form. |
| User-agent blocking | The user agent is a self-reported claim, and self-reported claims are trivially spoofed. Any script can present itself as the newest Chrome, and the well-built ones always do. |
| Honeypots | Hidden form fields catch naive crawlers that fill in everything they see. Anything better built inspects the page the way a browser renders it and steps around the trap without pausing. |
Each defense catches some signup bots, some of the time. A determined operator walks through all of them at once, with the unhurried confidence of somebody who did the same to four hundred forms this month. What is wanted is behavior-driven detection that looks deeper than surface-level signals, so a script cannot pass as a prospect.
What Signup Bots Cost Your SaaS
Automated registrations aren't just a nuisance. They degrade your product, waste your money, and leave you with a user table that no longer describes your customers.
Wasted resources
Every bot account consumes onboarding email, trial capacity, and compute you're paying for, and none of it converts.Data pollution
Fake signups and bot-generated events contaminate your analytics. Conversion rates, activation funnels, and engagement metrics stop meaning anything when a good share of your "users" are scripts that never meant to stay.Stockpiled accounts
Account-creation bots lay down fake users against campaigns not yet dreamed up: spam, scraping, trial cycling, or worse. The registration looks cheap in the moment and expensive the week you discover what the pile was for.How to Detect Signup Bots
Format checks won't catch a signup bot. The form is well-formed and the person behind it is fictional, so the work is to judge the registration: whether a human or a script submitted it, whether the device looks like a real browser on real hardware, whether the identity data was assembled from a word list, and whether the same device is producing a stream of similar accounts. Score those together, keep the evidence visible so you can confirm it isn't a false positive, and you can act before the fake account reaches onboarding.
Dregs evaluates each signup at the moment of submission along those lines, with custom rules and lists implemented as a pipeline of AI-assisted analyzers. Scores settle moments after new activity, and each one opens into its observations so you can see exactly why a registration was marked down.
Humanity Score
The Humanity score is the primary signup-bot signal. Dregs analyzes browser fingerprint characteristics that headless browsers struggle to fake: impossible hardware profiles, missing browser APIs, inconsistent rendering behavior, and dozens of other indicators. A real browser on real hardware is hard to counterfeit; a headless one claims a graphics card and then declines to render anything with it.
Behavior Score
Signup bots behave differently than humans, however carefully instructed otherwise. The Behavior score catches impossibly fast form completion, unnaturally uniform timing intervals, sessions that skip straight to the registration form, and interaction patterns that no human would produce. Even bots with randomized delays lack the natural variance of real human behavior, the randomness itself suspiciously even.
Authenticity Score
Signup bots generate identity data programmatically. The Authenticity score detects auto-generated names assembled from a word list, email addresses that follow predictable formats (sequential numbers, random character strings), and identity data that doesn't add up to a real person. Accounts manufactured at volume inevitably produce patterns, and an address that counts upward is not a subtle one.
Device Fingerprinting
Headless browsers leave distinctive device fingerprints, however earnestly they claim to be ordinary Chrome. Missing plugins, screen dimensions matching no real display, absent GPU rendering capabilities, and other hardware-level signals create a fingerprint that stands out. Dregs recognizes these patterns across sessions, IPs, and user agents, catching automated signups across multiple accounts.
Example: Catching a Signup Bot
With Dregs, here's what it looks like when an operator points a script at your registration form:
Nobody had to be woken up... the cycle finishes almost instantly, well before the bot clears its first batch of registrations. Each score opens into its observations, so you can see exactly why a signup was flagged, sparing your real users the false positives.
Responding to Signup Bots
Not every automated signup deserves the same response. Some you block immediately. Others you watch quietly. Dregs gives you the detection signals, plus custom rules and lists (badge rules and datasets, in Dregs terms) to decide how each is handled.
Total blocking
Accept the signup on the surface and provision nothing behind it. Best for clearly malicious registration bots. The campaign returns nothing on the investment, and your user table stays clean.
Rate limiting
Slow suspicious registrations with artificial delays and rate limits. Throughput collapses at the far end with no explanation, costing the operator time and proxy budget alike.
Silent monitoring
Watch without acting. Let the signup complete while you record its behavior, targets, and techniques. Useful when a false positive would be expensive, or when you want the evidence before you change the response.
Speed matters when responding to signup bots. By the time a human reviews an alert, the script has finished and gone home. Dregs webhooks let your application react near-instantly to suspicious activity, blocking or throttling the registration before it causes real damage, with less manual review in the loop.
Signup bots often show up as fake signups when the identity data is junk. If the accounts start cycling trials, see free trial abuse. If the addresses belong to real people who never visited, that's registration bombing. Credential stuffing is the same automation pointed at your login page instead of your registration form.
Frequently Asked Questions
Q: How do you detect signup bots?
A: You detect signup bots by scoring whether a registration was submitted by a person, not whether the form is well-formed. Useful signals include headless-browser fingerprints, impossibly fast form completion, generated names and sequential email addresses, and the same device producing a stream of accounts. CAPTCHAs, rate limits, and user-agent blocks miss this because solver farms, proxy networks, and spoofed browsers clear them cheaply. Dregs scores humanity, behavior, and authenticity at registration, and every score opens into its observations so you can see exactly why before you act.
Q: How can SaaS companies stop automated signups?
A: Detect them at the registration form, then respond in a way that matches how expensive a false positive would be: refuse to provision the account, slow the session, send only flagged signups to a review queue, or watch quietly. The useful moment is before onboarding, so no trial resources or conversion math is spent on a script. Dregs delivers scores by webhook almost as soon as the signup lands, so your application can quarantine the bot with less manual review.
Q: What is registration bot abuse?
A: Registration bot abuse is automated software submitting a product's signup form to create fake accounts at scale. Scripts rotate email addresses, IPs, and user agents so each registration looks like a new visitor, then stockpile the accounts for spam, trial harvest, or later campaigns. It is distinct from a human typing junk into the form, and from credential stuffing, which points the same automation at a login page. Dregs treats it as a signup-quality problem: score the registration, keep the evidence visible, and act before the fake account becomes a user.
Q: Will detecting signup bots create false positives?
A: It can, especially for privacy-conscious people on unusual browsers or unusual networks. That's why the response matters as much as the detection: keep the observations visible so you can check the evidence, and use graduated actions rather than a hard block on a single low score. Dregs scores several dimensions instead of one and opens every score into its observations, so you can confirm a flag isn't a false positive before you act.
Stop signup bots from creating fake accounts on your SaaS.
Dregs helps you detect automated registrations from the first page load. No training period, no rule tuning, no CAPTCHA tax on your real users.
Schedule a Demo