Case 001. A $1 signup grant, farmed at scale.
One public toolkit farmed an AI API platform's $1 signup grant and the free tiers of about 40 other services. This is what we found, what we reported and what was still up 12 days later. The client and the operator are redacted.
The bottom line
By 2 November two GitHub accounts and all eight of the farm's mail domains were down, and about 35 companies had been warned. The operator's own git server, a mail server, one GitHub account and a Telegram channel were still up and being chased.
How the farm worked
Gmail aliases, 14 October
Signups from variations of the same inbox. This stopped once the grant was limited to one per normalised inbox.
Catch-all mail domains, 17 October
Mailbox pools, then eight subdomains of a free domain service, all forwarding to the operator. A headless browser minted the captcha tokens and the verification codes were read automatically.
OAuth signups, from 19 October
The toolkit's README called the sign-in-with-GitHub route the main way in: it granted credit with no captcha. The operator claimed a pool of 672 GitHub accounts for it, a figure we couldn't verify.
Timeline
| Date | What happened |
|---|---|
| 12–14 Oct | First commits to the toolkit |
| 17–19 Oct | Farm repos published on GitHub |
| 21 Oct | Case opened. Reports to GitHub, Telegram, the domain providers and the mail forwarding service. First heads-ups to other targets |
| 23 Oct | First GitHub account removed. The same day, 26 repos restored on the operator's own git server |
| ~24 Oct | All eight farm mail domains wiped |
| 25–28 Oct | A successor GitHub account publishes about 15 farm repos, then is removed |
| 1 Nov | 13 new users join the operator's git server |
| 2 Nov | Evidence pack and web archives. Reports to the git server's host and registrar. 22 more companies warned |
Status on 2 November
| Asset | Status |
|---|---|
| GitHub account | Removed 23 Oct |
| 8 catch-all mail domains | Wiped ~24 Oct |
| Successor GitHub account | Removed 28 Oct |
| Third GitHub account | Live, reported |
| Self-hosted git server | Live, host reported 2 Nov |
| Mail server | Live, host reported 2 Nov |
| Telegram channel | Live, no reply yet |
Who else was targeted
The toolkit covered about 40 AI and API services. We warned about 35 of them. Some replied and hardened their signup flows; some had only a general inbox or a contact form; for a few we couldn't find a contact at all.
What we recommended
- Put a captcha on every signup route, OAuth included
- Weigh account age and activity before granting credit
- Block farm domains by parent, not subdomain
- Rate-limit grants per IP, ASN and device
- Hold the credit until the first real API call
- Audit existing grants and revoke farmed keys
These were recommendations. The client's developers decided what to change; Esuba doesn't touch client code. The reasoning behind each is in how to stop free credit farming.
What we learned
Takedowns work, and operators expect them: the git server went up the same day GitHub acted. That's why we track the operator, not just the asset.