Gmail and Google Workspace ignore dots in the local part of an address. john@gmail.com, j.ohn@gmail.com, and j.o.h.n@gmail.com all deliver to the same inbox. Yandex has the same kind of trick: a dot and a hyphen in the local part are interchangeable, so ivan.petrov@yandex.ru, ivan-petrov@yandex.ru and ivan-petrov@ya.ru are one mailbox. Either way, the mailbox owner can generate an effectively unlimited number of addresses that look distinct without creating a single new account.
Why it gets abused
Because every variant passes as a separate address, the trick is a standard tool for running one person through a system built for one signup per person. A single Gmail or Yandex account can claim a free trial, a referral bonus, or a promo code as many times as there are ways to place dots or hyphens in the local part — while every registration looks like a distinct real user to a database that only checks that the address exists.
How CleanContact detects it
CleanContact tracks the canonical mailbox behind every Gmail, Googlemail, Yandex and ya.ru address it checks, using the same rules as the normalized field: for Gmail the dots are stripped from the local part and the domain becomes gmail.com; for Yandex every hyphen becomes a dot and the domain becomes yandex.ru. Distinct raw spellings of the same canonical mailbox are counted per API key within a rolling time window. Once two or more different spellings of the same mailbox have been submitted, every further check of that mailbox returns a risk object alongside the normal verdict. Both providers report under the same gmailDotTrick flag.
Example
A validation call behaves exactly as before:
curl -H "X-API-Key: <your-key>" \
"https://api.cleancontact.ru/validate?email=j.o.h.n.doe@gmail.com"Once a second dotted spelling of the same mailbox has been seen, the response gains a risk field:
{
"value": "j.o.h.n.doe@gmail.com",
"result": {
"status": "Good",
"detail": "Mailbox accepts mail"
},
"risk": {
"gmailDotTrick": true,
"aliasOf": "johndoe@gmail.com",
"seenVariants": 3
}
}A Yandex address works the same way — here ivan.petrov@yandex.ru was checked earlier, and the hyphenated ya.ru spelling collides with it:
{
"value": "ivan-petrov@ya.ru",
"normalized": "ivan.petrov@yandex.ru",
"result": {
"status": "Good",
"detail": "Mailbox accepts mail"
},
"risk": {
"gmailDotTrick": true,
"aliasOf": "ivan.petrov@yandex.ru",
"seenVariants": 2
}
}What it does for you
- Catch multi-accounting at signup — flag or block a registration that reuses a mailbox already seen under a different spelling, before a free trial or promo code is claimed twice.
- Keep the verdict honest — Good, Bad, or Unknown never changes because of the risk signal. The mailbox is genuinely deliverable either way; risk only tells you it is not a unique person.
- See the pattern, not just one hit — seenVariants tells you how many distinct spellings have shown up, so a mailbox with two variants and one with twelve can be handled differently.
The signal needs at least two different spellings of the same mailbox before it fires — a single check of any address, however it is spelled, returns no risk field. Tracking is scoped to your own API key, so it only reflects traffic on your own signup flow, and there is nothing to configure to turn it on.