Stopping Abuse at Scale: Inside a Disposable-Email Anti-Abuse Architecture
A free inbox in one click is a gift to spammers and bot farms. Here is the layered architecture — edge filtering, device fingerprinting, a risk-scoring engine and graded challenges — that keeps a disposable-email service clean without punishing real users.
EvilMail TeamJuly 7, 20269 min read
Handing out a working email inbox in a single click is a wonderful product experience — and a standing invitation to abuse. The same friction we remove for a privacy-conscious shopper, a QA engineer, or a developer testing a signup flow is friction that spam operators, credential-stuffing bots, and OTP farms would love to see gone too. A disposable-email service that ignores this reality does not stay online for long: its domains get blocklisted, its IPs get throttled, and the legitimate users it was built for quietly stop receiving mail.
So the interesting engineering problem behind temp mail is not "how do we create an inbox." That part is easy. The hard part is deciding whether we should — thousands of times per second, in a few milliseconds, without asking a real human to solve a puzzle every time they want to sign up for a newsletter. This is a walk through the architecture that makes that decision: what each layer does, why it exists, and the tradeoffs that come with it.
The threat model comes first
Every defense decision is downstream of a clear threat model. Before writing a single rule, it helps to name who is actually attacking a disposable-email endpoint and what they want:
Spam and phishing relays — actors who create inboxes to receive verification links, then use the underlying accounts to blast spam. Their goal is volume.
OTP and verification farming — bots that mass-register on third-party platforms, using temp inboxes to catch one-time codes. Their goal is throughput of fresh, "clean-looking" addresses.
Disposable-Email Anti-Abuse Architecture: Stopping Bots at Scale — EvilMail Blog
Scrapers and resellers — automation that treats your API as free infrastructure, generating inboxes at scale to power someone else's product.
Carding and fraud rings — actors validating stolen data behind a throwaway identity.
Notice what these have in common: they are all high-volume, automated, and economically motivated. That is good news, because it means the defense does not need to be perfect against a single determined human. It needs to make automation expensive — to raise the cost per inbox until the abuse stops paying for itself, while keeping the cost for a real person at effectively zero.
Defense as a funnel, not a wall
The instinct of a lot of teams is to build one big gate: a CAPTCHA, or a single "is this a bot" check. That fails in both directions. It annoys real users, and sophisticated automation walks right through it. A far more effective model is a funnel — a series of cheap-to-expensive checks, where each layer removes a slice of bad traffic so the expensive checks only ever run on the traffic that survived.
Request processing funnel: incoming requests pass through edge and WAF filtering, rate and velocity checks, device fingerprinting, and risk-engine scoring before an inbox is created, with each layer filtering out a percentage of abusive traffic.
The exact percentages vary by day and by how much a botnet is currently pointed at you, but the shape holds. The cheapest checks run first and remove the most obvious offenders; by the time a request reaches the risk engine — the most expensive layer — the population has already been thinned dramatically. This ordering is the whole game. Running an expensive machine-learning scorer on 100% of traffic is wasteful; running it on the 20% that survived edge filtering and rate limiting is affordable.
The architecture, layer by layer
Here is how those funnel stages map onto real infrastructure. Requests flow left to right; the risk engine sits at the center and pulls signals from every layer before a decision is made.
Anti-abuse system architecture: client requests pass through the Cloudflare edge (WAF, bot management, TLS fingerprinting), an API gateway (origin and CSRF checks, API-key auth, rate limiting), and a risk engine that scores each request using signals like IP reputation, ASN, device fingerprint, request velocity, honeypot fields and API-key reputation, before a decision routes the request to allow, challenge, or deny.
1. The edge (Cloudflare / WAF)
The first and cheapest line of defense is the edge. Before a request ever touches application code, the edge drops traffic from known-bad IP ranges, applies WAF rules for obvious attack patterns, and — importantly for bot detection — inspects the TLS handshake. A JA3/JA4 TLS fingerprint often reveals an automation library (a raw curl, a headless client, a scripting runtime) even when the request headers are carefully forged to look like a browser. Traffic that fails here costs you nothing: it is rejected before it consumes a database connection or a CPU cycle in your own stack.
2. The API gateway
Surviving requests hit the gateway, which enforces the boring-but-critical basics: origin and CSRF validation for browser sessions, API-key authentication for programmatic callers, and the first serious layer of rate limiting. Rate limits here are multi-dimensional — not just "N requests per IP per minute," but per subnet, per API key, and per behavioral bucket. A single IP making 5 requests a minute is fine; a /24 subnet collectively making 5,000 is not, even if no individual address looks abusive.
3. The risk engine
This is where the real decision happens. The risk engine does not make a binary bot/not-bot call. It computes a score from many weak signals, because no single signal is trustworthy on its own. A datacenter IP is suspicious but not proof — plenty of legitimate developers test from cloud instances. A reused device fingerprint is suspicious but not proof — shared office networks exist. It is the combination that is damning.
Signals: many weak indicators beat one strong one
The engine blends signals from across the stack. The most useful ones, roughly in order of value:
IP and ASN reputation — is this address on a threat feed? Does it belong to a hosting/datacenter ASN rather than a residential or mobile network? Datacenter traffic requesting throwaway inboxes is a strong abuse indicator.
Device fingerprint — a stable hash derived from browser and TLS characteristics. The signal is not the fingerprint itself but its reuse rate: one fingerprint minting hundreds of inboxes an hour is a farm.
Request velocity — acceleration matters more than raw count. A sudden spike from an IP, subnet, or fingerprint that was quiet a minute ago is the shape of a botnet spinning up.
Honeypot fields — invisible form fields and unadvertised parameters that a human never touches but naive automation dutifully fills. A honeypot hit is close to a hard signal.
API-key reputation — for programmatic traffic, the key's own history: its age, its historical abuse rate, its plan tier.
Weighting these is deliberately conservative. The goal is a score where legitimate users almost never accumulate enough points to be challenged, and automation almost always does — because automation, by its nature, trips several signals at once.
From score to action
A score on its own does nothing. It has to map to an action, and the mapping is where the product tradeoffs live. A binary allow/deny is tempting but brittle: set the threshold too low and you block real users; set it too high and abuse leaks through. The better answer is a graded response with a middle tier.
Risk scoring and decision flow: a new inbox or OTP request is evaluated against blocklist and honeypot checks (hard deny), datacenter ASN, fingerprint reuse, velocity spikes and JS/TLS anomalies, each adding to an aggregate risk score; scores under 30 are allowed, 30 to 70 trigger a challenge such as proof-of-work or a captcha, and scores over 70 are denied and logged.
The three-tier structure is what keeps the experience humane:
Low score — allow. The overwhelming majority of real users land here and never see a speed bump. An inbox is created instantly.
Medium score — challenge. Rather than block, ask for a small proof. A lightweight proof-of-work computation, a silent JavaScript challenge, or, only as a last resort, a visible CAPTCHA. This tier is the pressure valve: it lets ambiguous-but-probably-fine traffic through at a tiny cost, and it makes automation expensive because a bot farm now has to burn CPU on every single attempt.
High score — deny. Blocked and logged for review. The log matters: today's denied requests are tomorrow's rules and threat-feed entries.
Proof-of-work deserves a note, because it is the quiet workhorse here. Asking a client to compute a small hash puzzle is invisible to one person creating one inbox. But to an operation creating a million inboxes, it turns "free" into a real, compounding compute bill. It shifts the economics without a support-ticket-generating CAPTCHA wall — exactly the asymmetry you want.
The tradeoffs nobody escapes
No anti-abuse system is free, and pretending otherwise is how teams build defenses that quietly hurt their own users. The honest tradeoffs:
False positives are real. Someone on a VPN, a corporate NAT, or a cloud IDE will occasionally look like a bot. This is exactly why the middle "challenge" tier exists — so a false positive costs a real user a two-second delay, not a locked door.
Every signal has a shelf life. Fingerprinting techniques get defeated; threat feeds go stale; attackers rotate ASNs. A risk engine is not a project you finish, it is a system you maintain. Static rules decay.
Logging is not optional. You cannot tune what you cannot see. The value of denying a request is partly the block and partly the labeled example it produces for the next iteration.
Why this matters to legitimate users
It is easy to read all of this as adversarial machinery, but its real purpose is to protect the people the service exists for. Abuse is not a victimless background process — it is the direct cause of the two things that ruin a disposable-email service for everyone:
Deliverability. When abusers relay spam through your domains, mailbox providers blocklist those domains. Then a legitimate user's genuine verification email lands in spam — or never arrives. Keeping abuse out is, functionally, how you keep the mail flowing in.
Availability and cost. Unchecked automation is a denial-of-service on your own infrastructure and your own budget. Every inbox a bot farm creates is capacity taken from a real user.
This is the frame worth holding onto: a well-built anti-abuse layer is not there to distrust users. It is there so that the free tier can stay free, the API can stay clean, and a real person clicking "create inbox" gets exactly what they came for — instantly, with no puzzle to solve, on a domain that mailbox providers still trust.
Takeaways
Start from a threat model. Temp-mail abuse is high-volume and automated, so the goal is to make automation expensive, not to build a perfect wall.
Layer cheap-to-expensive checks as a funnel so your costly logic only runs on traffic that already survived the basics.
Score with many weak signals rather than trusting one strong one — the combination is what separates a bot from a developer on a cloud IP.
Use a graded allow / challenge / deny response so false positives cost seconds, not access.
Treat it as a living system: log everything, expect signals to decay, and keep iterating.
The best compliment an anti-abuse system can receive is that nobody legitimate ever notices it is there.
