[mpaepper]

I mean I run a SaaS and get many fake registered users / bots.

What I did for now is:

- Added a honeypot field (invisible to users, but bots might fill it) -> if it's filled, instant reject - Added a check for spammy domains -> if it's from such a domain, instant reject

[ATechGuy]

Honeypots may be skipped by bots. My simple solution to this is to create an input/text field in the account creation form, add a placeholder text "I am human" and ask the user to enter what they see (i.e., placeholder text). I've never received any fake/spam account since I incorporated this technique.

[ciwolex]

This is smart. Are there scenarios you've noticed that it doesn't work?

[mpaepper]

I've just added it :D

But I would guess that there will be new domains that I don't have in my blocklist and then I need to add them again and I would like to have this as a crowdsourced effort.