Farm toolkits, taken down and kept down.
A farm toolkit is everything that lets anyone farm your signup flow: the repos and scripts, the mail domains, the servers and the channels that promote them. Esuba takes down every piece and watches for the next copy.
What a toolkit is made of
| Piece | Where it lives | Who we report to |
|---|---|---|
| Code | GitHub repos and gists, self-hosted Gitea, Forgejo or GitLab | GitHub, or the server's host and registrar |
| Catch-all domains and forwarding that receive your verification codes | The domain provider, registrar and mail service | |
| Servers | Self-hosted git and mail servers | The hosting provider |
| Distribution | Telegram channels, X and Reddit posts, forums | The platform |
| Accounts | Pools of accounts for OAuth signups | The platform that hosts them |
Why one takedown isn't enough
Operators expect takedowns. In Case 001, GitHub removed the first account and the same day 26 of its repos reappeared on the operator's own git server. A successor GitHub account then published about 15 farm repos before it was removed too.
So we track the operator, not just the asset. Every successor, mirror and new server is tied to the same profile and reported again.
How a takedown runs
Capture
Before anything is reported, we archive the repos, commits, DNS, RDAP and hosting records and web pages, with SHA-256 checksums.
Find everyone involved
Platform, hosting provider, registrar, mail provider: each gets its own report through the channel it acts on. Here's how that works.
Report from your domain
You authorize us once at onboarding. After that, every report goes out from your domain as soon as the finding is verified.
Follow up
Daily checks on every asset, and a follow-up after seven days of silence.
Warn the other targets
Toolkits rarely target one company. In Case 001 we warned about 35 other companies the same operator was hitting.
Questions
Is this a DMCA takedown?
Usually not. DMCA covers copied content, and farm toolkits rarely copy your code. We report under each platform's and host's own abuse policies, with evidence of the abuse.
How long do takedowns take?
It depends on the provider. In Case 001 the first GitHub account was gone in two days and the farm's mail domains in about three. Some hosts take weeks.
What if the operator just moves?
They usually do. Successors, mirrors and new infrastructure are reported under the same case, and your weekly report shows what's still live.