Every fake signup is a grant you paid for.
Free credits get farmed with fake accounts, OAuth pools and catch-all mail domains. In Case 001 the operator claimed a pool of 672 GitHub accounts.
Find and take down the people farming your free credits.
- See exactly who is farming your credits, and how they get in
- Find out what it's costing you in grants, compute and fake growth
- Get a clear path to shut them down, fast
Watched every weekday
- GitHub
- Self-hosted git
- Telegram
- X
- Hacker News
- Forums
- DNS & cert logs
Farmers aren't just annoying. They're burning your runway.
Your growth numbers stop being real.
Farmed signups inflate the funnel, skew activation and bury real users. You end up planning, hiring and fundraising on numbers that aren't.
Your keys end up for sale.
Farmed and leaked keys get pooled and resold on grey-market panels, so your compute serves someone else's customers. The Case 001 operator claimed a bank of 703+ keys.
AI detection. Human review. No let-up.
-
Agents scan where the farms live.
One agent per platform searches GitHub, self-hosted git, Telegram, X, Reddit, Hacker News and the forums every weekday for your name, endpoints and signup flow.
-
Analysts build a case that holds.
Agents flag, people confirm. Every hit is captured before it's reported: repos, commits, DNS, RDAP, hosting and Wayback archives, checksummed so it still stands after they delete everything.
-
Reported as soon as it's verified.
No drafts waiting on your team. Each report goes out from your own domain, so hosts deal with the rights holder.
-
We chase it until it's gone.
Reports to platforms, hosts, registrars, mail providers and messaging apps. Daily checks, follow-ups when they go quiet, and heads-ups to every other vendor the same operator is hitting.
Case 001. A $1 signup grant, farmed at scale.
- Farm accounts removed in 7 days
- 2
- Catch-all mail domains wiped in ~3 days
- 8
- Vendors warned about the same operator
- ~35
- Companies targeted by one toolkit
- ~40
- Client
- redacted · AI API platform
- Operator
- redacted
- Opened
- 21 Oct 2026
- Updated
- 2 Nov 2026
- Status
- Open
What we found
- A public toolkit farmed the client's $1 signup grant and the free tiers of about 40 other services.
- Three ways in within five days: Gmail aliases, then catch-all mail domains with captcha tokens minted by a headless browser, then an OAuth signup route with no captcha at all.
- When GitHub removed the first account, 26 repos reappeared on the operator's own git server the same day.
What we recommended
- Put a captcha on every signup route, OAuth included
- Weigh account age and activity before granting credit
- Block farm domains by parent, not subdomain
- Rate-limit grants per IP, ASN and device
- Hold the credit until the first real API call
Assets
| Asset | Status |
|---|---|
| GitHub account | Gone 23 Oct |
| 8 catch-all mail domains | Wiped ~24 Oct |
| Successor GitHub account | Gone 28 Oct |
| Third GitHub account | Live · reported |
| Self-hosted git server | Live · host reported 2 Nov |
| Mail server | Live · host reported 2 Nov |
| Telegram channel | Live · no reply yet |
Don't compare us to a fraud score.
| Capability | Esuba | Fraud scoring | In-house team | Outside counsel |
|---|---|---|---|---|
| Finds the toolkit behind the signups | Every weekday | When there's time | ||
| Evidence hosts and registrars act on | With every report | Sometimes | Slowly | |
| Takedowns tracked until gone | Daily checks | Ad hoc | Per letter | |
| Warns the other vendors being hit | Peer network | |||
| Tracks the operator when they come back | Operator profiles |
Aggressive on farms. Careful with everything else.
-
Hands-off for your team
We send every report, form and follow-up ourselves. Nothing sits in your inbox waiting for a sign-off.
-
Sent from your domain
Hosts and platforms deal with the rights holder, which is who they act fastest for.
-
Public reads only
We never log in to their systems, use leaked credentials or run their tools. No hacking back, ever.
-
Weekly status reports
What's down, what's still live and for how long, who replied, and what changed with the operator.
-
Successor tracking
When they come back under a new name, we tie it to the same operator profile and report it again.
-
We advise, you fix
We show how the farm beats your signup flow and what would stop it. Your engineers decide what to ship.
One desk. One price.
$2,000/ month
Start with a free report- Weekday watch across GitHub, self-hosted git, Telegram, X, Reddit and forums
- Your name, endpoints and signup flow as watch terms
- An evidence pack for every finding, with SHA-256 checksums
- Takedowns sent for you from your domain as soon as each finding is verified
- Daily tracking and follow-ups until each asset is down
- Operator profiles that catch successors, mirrors and new infrastructure
- Heads-ups to the other vendors being hit
- A weekly report, with recommendations for hardening your signup flow
The path to your first takedown.
-
Free farm exposure report
We search public sources for toolkits, posts and repos aimed at your signup flow, and send you what we find.
-
A short call
We walk through the findings and show exactly how we'd shut it down.
-
Set up your desk
A short intake: your watch terms, the domain reports go out from, and a one-time authorization to report on your behalf.
-
First takedowns sent
Evidence packs for everything live, and a report to every platform and host behind it.
Questions, answered straight.
How does Esuba work?
Esuba is your abuse desk. AI agents watch the places farm toolkits live. Analysts verify every hit, capture the evidence and send the takedowns from your domain. Then we track every asset until it's gone.
How much does it cost?
$2,000 a month. There's one plan and everything on this page is in it: the watch, the evidence, the takedowns, the tracking and the operator profiles. It starts with a free farm exposure report, so you see what we find before you pay anything.
Can't my team just handle this?
They can try. Finding the toolkits means watching GitHub, self-hosted git, Telegram and forums every day. Getting them down means evidence hosts accept, the right abuse channel for each provider, and weeks of follow-ups. Most AI startups don't have a trust & safety team, let alone the hours.
Won't they just come back?
Usually, yes. In Case 001 the operator moved 26 repos to their own git server the same day GitHub removed the account. That's why we track the operator, not just the asset: successors, mirrors and new infrastructure get reported too.
How long does a takedown take?
It depends on the provider. In Case 001 the first GitHub account was gone in 2 days and the farm's mail domains in about 3. Some hosts take weeks. We follow up after seven days of silence and report on every asset until it's down.
Do you need access to our systems?
No. We work from public sources. If you share signup or grant data, we use it to confirm which accounts were farmed, but that's optional.
Who actually sends the reports?
We do. You authorize us once when we set up your desk. After that, each report goes out from your own domain with its evidence as soon as the finding is verified, and every one shows up in your weekly report.
Will you fix our signup flow?
No. We explain how the farm beats your flow and what kind of change would stop it. Your engineers decide what to build. We never touch your code.
Do you hack back?
Never. No logging in to operator systems, no leaked credentials, no running their tools. Public reads only.