Disposable email domains and datacenter IPs are the two silent leaks in almost every SaaS free-trial funnel. Here's what they actually cost you, and a lightweight way to filter them before they ever reach your signup form.
The problem: your "free trial" is a free API
Every SaaS founder knows the feeling: 1,000 signups, 50 activated accounts, 3 paying customers. Some of that drop-off is normal onboarding friction. But a surprising chunk is abuse — people who never intended to pay, using:
- Disposable email domains (temp-mail.org, guerrillamail.com and ~8,000+ others) to mint unlimited accounts
- Datacenter IPs (AWS, GCP, Azure, DigitalOcean, Vultr, OVH) to bypass per-IP limits and rate caps
- Multi-account farms that harvest your free tier, resell API keys, or game referral rewards
One-time emails are the best-known vector. But the datacenter-IP vector is worse: one attacker with a $5 VPS can rotate through hundreds of IPs, and your geo/IP-based limits become decoration.
What most teams do (and why it doesn't work)
- Nothing — until someone hits the abuse report.
- Email verification services — catches typos, but a disposable address is a valid address. It passes verification.
- Enterprise fraud stacks (Sift, DataDome, Cloudflare Turnstile) — genuinely powerful, but priced and configured for enterprises. For a bootstrapped SaaS, they're a big integration and a bigger invoice.
A 3-line mental model
When a signup comes in, score three things before creating the account:
- Email domain reputation — is it in the disposable-email blacklist? (~8,200 domains and growing)
- IP risk — is the request coming from a known cloud/datacenter range?
- Combined risk score — weighted, so one signal alone doesn't false-positive a legitimate user (e.g. a dev on a VPS testing your product).
The output is a single score: 0 = allow, 60+ = block or require verification. Legit users on normal IPs with normal emails are never touched; abusers get filtered at the door.
Shipping this in an afternoon
You don't need a fraud platform for the first 90% of the problem. A self-hosted API with:
- A disposable-domain blacklist (open-source lists cover ~8,200 domains)
- Cloud-provider CIDR ranges for the big providers
- A weighted scoring endpoint (email 60% / IP 40%)
...handles the common abuse patterns. I packaged exactly this as TrialShield — a single FastAPI service with the blacklist + datacenter-IP detection + risk scoring, self-hosted on your own VPS ($49 one-time, no per-request fees, no vendor lock-in).
The honest trade-offs
- False positives: a developer signing up from a DigitalOcean droplet gets a risk score. That's correct behavior — you can add an allowlist for your own engineering ranges.
- It's not a full fraud platform: no device fingerprinting, no behavioral analysis. If you're a fintech handling payments, buy the enterprise stack. If you're a bootstrapped SaaS losing margin to free-tier abuse, this closes the leak for $0/month in running costs.
The abuse isn't going away — every free tier that doesn't filter is subsidizing someone's scraping farm. Filter at the door. 🚪
Top comments (0)