flogiston

Blog

Mysql: determine cheaters emails

· admin · Dev, MySQL

At the office we often develop apps for campaign contests. Obviously we often have to deal with cheaters: users who register using either disposable email addresses or catch-all domains. This sql snippet detects possible culprits. Obviously manual checks by an operator is required to verify suspicious accounts.

Here's a list of disposable email services:
http://www.listable.org/show/temporarydisposable-email-services

Determine cheaters

We also check on "email tags": eg. gmail allows you to add a '+' sign to "tag" your emails. They all end up in your gmail inbox, but you'll know if your email has been passed to third parties by adding a special tag each time you register for a site.
eg: yourname+yourfavouriteeshop@gmail.com


SELECT email, emaildomain, cheaters from participants inner join (
select count(id) as cheaters, 'email tags' as cheattype, SUBSTRING_INDEX(email, '@', -1) as emaildomain
 from users where email like('%+%') group by cheattype, emaildomain
 union
 select count(id) as cheaters, 'disposable email addresses' as cheattype, SUBSTRING_INDEX(email, '@', -1) as emaildomain
 from users where SUBSTRING_INDEX(email, '@', -1) IN
 ('slopsbox.com', 'mailinator.com', 'mailinator2.com', 'sogetthis.com', 'mailin8r.com', 'mailinator.net', 'spamherelots.com', 'thisisnotmyrealemail.com',
 'mytrashmail.com', 'mailexpire.com', 'maileater.com', 'guerrillamailblock.com', 'temporaryinbox.com', 'spam.la', 'spamfree24.org', 'tempemail.net',
 'spambox.us', 'jetable.net', 'jetable.org', 'tempemail.com', 'nowmymail.com', 'mailcatch.com', 'mailexpire.com', 'whopy.com', 'mailquack.com', 'litedrop.com',
 'dodgeit.com', 'dodgit.com', 'tempomail.fr', 'kasmail.com', '10minutemail.com', 'mailop.com', 'mailcatch.com', 'spamgourmet.com', 'e4ward.com', 'bsnow.net', 'mt2009.com',
 'trashymail.com', 'mytrashmail.com', 'mintemail.com', 'mailcatch', 'mailexpire', 'yopmail.com', 'yopmail.com', 'yopmail.fr', 'yopmail.net', 'yopweb.com', 'jetable.fr.nf',
 'nospam.ze.tc', 'nomail.xl.cx', 'mega.zik.dj', 'speed.1s.fr', 'cool.fr.nf', 'courriel.fr.nf', 'moncourrier.fr.nf', 'monemail.fr.nf', 'monmail.fr.nf',
 'justonemail.net', 'letmymail.com', 'onemoremail.net')
 group by cheattype, emaildomain
 union
 select count(id) as cheaters, 'catch-all domains' as cheattype, SUBSTRING_INDEX(email, '@', -1) as emaildomain
 from users where SUBSTRING_INDEX(email, '@', -1) not in
 ('hotmail.com','gmail.com','telenet.be','msn.com','live.be','skynet.be','pandora.be',
 'yahoo.com','hotmail.be','live.nl','scarlet.be',
 'slopsbox.com', 'mailinator.com', 'mailinator2.com', 'sogetthis.com', 'mailin8r.com', 'mailinator.net', 'spamherelots.com', 'thisisnotmyrealemail.com',
 'mytrashmail.com', 'mailexpire.com', 'maileater.com', 'guerrillamailblock.com', 'temporaryinbox.com', 'spam.la', 'spamfree24.org', 'tempemail.net',
 'spambox.us', 'jetable.net', 'jetable.org', 'tempemail.com', 'nowmymail.com', 'mailcatch.com', 'mailexpire.com', 'whopy.com', 'mailquack.com', 'litedrop.com',
 'dodgeit.com', 'dodgit.com', 'tempomail.fr', 'kasmail.com', '10minutemail.com', 'mailop.com', 'mailcatch.com', 'spamgourmet.com', 'e4ward.com', 'bsnow.net', 'mt2009.com',
 'trashymail.com', 'mytrashmail.com', 'mintemail.com', 'mailcatch', 'mailexpire', 'yopmail.com', 'yopmail.com', 'yopmail.fr', 'yopmail.net', 'yopweb.com', 'jetable.fr.nf',
 'nospam.ze.tc', 'nomail.xl.cx', 'mega.zik.dj', 'speed.1s.fr', 'cool.fr.nf', 'courriel.fr.nf', 'moncourrier.fr.nf', 'monemail.fr.nf', 'monmail.fr.nf',
 'justonemail.net', 'letmymail.com', 'onemoremail.net')
group by cheattype, emaildomain
 having count(id)>20
 ) cht on SUBSTRING_INDEX(email, '@', -1)=emaildomain
order by cheaters, emaildomain, email desc

1 comment

Gerold Setz ·

Hi,

have a look at http://www.block-disposable-email.com/ which is a service to block anonymous subscribers.

Hope you like it,

Gerold