1) New accounts are scanned automatically

The scanner runs on a configurable interval or in real time via Mastodon webhooks, checking new signups as they arrive.

2) A risk score is assigned based on 70+ signals

Username patterns, email analysis, profile completeness, signup timing, IP reputation, and more are each weighted and summed into a 0–100 score.

3) Actions are applied based on configurable thresholds

Accounts that cross your thresholds are automatically silenced, frozen, or suspended — no manual review needed for obvious bots.

Each signal adds points to the account's risk score. You can enable or disable any signal.

👤 Username

• Suspicious character patterns
• Excessive numeric suffixes
• Known bot naming conventions

✉️ Email

• Disposable email providers
• Suspicious TLD patterns
• Commercial & payment domains

🪪 Profile

• Missing avatar or header
• Empty bio
• No posts after signup

🕐 Timing

• Late-night signups (1am–6am)
• Configurable timezone

🔍 IPQualityScore (optional API key)

Email fraud score

• Honeypot / spam trap
• Disposable email (IPQS)
• Recent email abuse

IP fraud score

• VPN / proxy detection
• Bot activity flag
• Recent IP abuse

Every aspect of the scoring system can be tuned to fit your community's needs.
⚖️

Action thresholds

Set independent score cutoffs for silence/limit, freeze, and suspend. Accounts scoring below all thresholds are left alone.
🎛️

Per-signal weights and toggles

Enable or disable any individual check. Adjust score weights so signals that matter more to your instance have greater impact.
📋

Custom domain & keyword lists

Maintain your own lists of suspicious TLDs, commercial domain keywords, and payment processor domains used in email addresses.
🔬

Dry-run mode

Preview exactly which accounts would be actioned and why, without making any changes. Tune your rules until you're confident, then go live.
⏱️

Flexible trigger modes

Run on a scheduled interval to catch up on recent signups, or use Mastodon's account.created webhook for real-time scanning the moment an account is created.