Gmail and Google Workspace ignore dots in the local part of an address. john@gmail.com, j.ohn@gmail.com, and j.o.h.n@gmail.com all deliver to the same inbox. The mailbox owner can generate an effectively unlimited number of addresses that look distinct without creating a single new account.
Why it gets abused
Because every dotted variant passes as a separate address, the trick is a standard tool for running one person through a system built for one signup per person. A single Gmail account can claim a free trial, a referral bonus, or a promo code as many times as there are ways to place dots in the local part — while every registration looks like a distinct real user to a database that only checks that the address exists.
How CleanContact detects it
CleanContact tracks the canonical mailbox behind every Gmail and Googlemail address it checks: dots stripped from the local part, domain normalized to gmail.com. Distinct raw spellings of the same canonical mailbox are counted per API key within a rolling time window. Once two or more different spellings of the same mailbox have been submitted, every further check of that mailbox returns a risk object alongside the normal verdict.
Example
A validation call behaves exactly as before:
curl -H "X-API-Key: <your-key>" \
"https://api.cleancontact.ru/validate?email=j.o.h.n.doe@gmail.com"Once a second dotted spelling of the same mailbox has been seen, the response gains a risk field:
{
"value": "j.o.h.n.doe@gmail.com",
"result": {
"status": "Good",
"detail": "Mailbox accepts mail"
},
"risk": {
"gmailDotTrick": true,
"aliasOf": "johndoe@gmail.com",
"seenVariants": 3
}
}What it does for you
- Catch multi-accounting at signup — flag or block a registration that reuses a mailbox already seen under a different dotted spelling, before a free trial or promo code is claimed twice.
- Keep the verdict honest — Good, Bad, or Unknown never changes because of the risk signal. The mailbox is genuinely deliverable either way; risk only tells you it is not a unique person.
- See the pattern, not just one hit — seenVariants tells you how many distinct spellings have shown up, so a mailbox with two variants and one with twelve can be handled differently.
The signal needs at least two different spellings of the same mailbox before it fires — a single check of any address, however it is dotted, returns no risk field. Tracking is scoped to your own API key, so it only reflects traffic on your own signup flow, and there is nothing to configure to turn it on.