Free credit farming, taken down at the source.
Free credit farming is one operator creating hundreds of accounts to claim your signup grant again and again, then using or reselling the credit. Esuba finds the toolkit doing it, reports every piece of infrastructure behind it, and keeps reporting until it's gone.
How a credit farm works
A farm is rarely one person clicking sign up. It's a toolkit: scripts that create accounts, get past your captcha, read the verification email and claim the grant. Toolkits are shared on GitHub and promoted on Telegram, so anyone can run them.
They're also built to be reused. In Case 001, one toolkit targeted an AI API platform's $1 signup grant and the free tiers of about 40 other services. It found three ways in within five days:
- Gmail aliases. Many signups from variations of the same inbox.
- Catch-all mail domains. Fresh addresses on throwaway domains, with captcha tokens minted by a headless browser and verification codes read automatically.
- OAuth signups. A sign-in-with-GitHub route that granted credit with no captcha at all.
Each time one door closed, the operator moved to the next. Blocking at the signup form on its own rarely ends it.
What it costs you
Every farmed account is a grant you paid for, and the numbers add up fast: the Case 001 operator claimed a pool of 672 GitHub accounts ready to sign up.
Farmed accounts also inflate signups and bury activation, so your growth numbers stop meaning much. And farmed credit tends to end up for sale; see resold API keys.
How Esuba stops it
Watch where farms are built
Agents search GitHub, self-hosted git servers, Telegram, X, Reddit, Hacker News and forums every weekday for your name, endpoints and signup flow.
Prove it
Analysts confirm each hit and capture the repos, commits, DNS, RDAP, hosting records and web archives, checksummed so the evidence still stands after the operator deletes it.
Report everything behind it
Reports go out from your domain to every platform, host, registrar and mail provider involved, as soon as the finding is verified.
Track the operator
We check daily, follow up after seven days of silence, and tie successor accounts and mirrors back to the same operator.
What your team fixes
We show how the farm gets past your signup flow and what kind of change would stop it, such as gating the grant on account signals or holding credit until the first real API call. Your engineers decide what to build; we never touch your code. The full list is in how to stop free credit farming.
Questions
Isn't this just multi-accounting?
It's multi-accounting at scale, with tooling. That difference matters: the tooling is public and reusable, so taking it down protects you and every other service it targets.
Can't we just block disposable email domains?
Do it, and block by parent domain so every subdomain is covered. But farms move on. In Case 001 the operator went from Gmail aliases to catch-all domains to OAuth signups within five days.
Do you need our signup data?
No. We work from public sources. If you share grant data, we use it to confirm which accounts were farmed, but that's optional.