Not every address that passes a mailbox check was actually typed by a person. Tooling built to generate a fresh-looking address on every signup tends to produce a local part with a shape no real person would bother typing. CleanContact looks for that shape and flags it the moment it sees it, without needing to see the address twice.
Why it matters
Signals that rely on history — like the Gmail Dot Trick, which needs to see the same mailbox spelled two different ways — always let the first fraudulent signup through for free, because there is nothing yet to compare it against. An address that does not look like something a person would type is suspicious on its own, before any history exists, so it can be flagged or blocked on the very first request.
What counts as suspicious
The check looks only at the shape of the address you send — no lookup, no history, no time window. It is not limited to one provider or one pattern: it looks for spellings that do not match how people actually write their own name, as opposed to the patterns a script produces when it needs endless distinct-looking versions of one mailbox. The exact patterns checked are not fixed — CleanContact adds new ones as new abuse patterns show up, so treat risk.suspicious as an evolving signal rather than one fixed rule.
Example
One pattern it currently catches: a Gmail or Googlemail address whose local part carries three or more dots. Real people write their name with at most one or two — first.last, or first.middle.last — but an address like shaff.e.r.t.ane.s.h.ia.8.3.6@gmail.com is not a name anyone would type; it reads like the output of a generator producing endless spellings of the same mailbox.
curl -H "X-API-Key: <your-key>" \
"https://api.cleancontact.ru/validate?email=shaff.e.r.t.ane.s.h.ia.8.3.6@gmail.com"The response carries a risk field on this first request, with no history required:
{
"value": "shaff.e.r.t.ane.s.h.ia.8.3.6@gmail.com",
"result": {
"status": "Good",
"detail": "Mailbox accepts mail"
},
"risk": {
"suspicious": true
}
}suspicious and gmailDotTrick are independent signals and can both be present in the same risk object — an address that trips this check and later gets resubmitted under yet another spelling will carry both.
What it does for you
- Block on the first attempt — no need to wait for a second signup to confirm a pattern, unlike a history-based signal such as the gmail dot trick.
- Keep the verdict honest — Good, Bad, or Unknown never changes because of the risk signal; the mailbox may be perfectly deliverable and still be flagged suspicious.
- Nothing to configure — the check runs on every request to every API key at no extra cost, and keeps covering new patterns as they are added.