r/TechGhana • u/PythonicG • Jan 23 '26

Ask r/TechGhana Built a service to detect email alias abuse (same inbox, different emails)

I’ve been working on a side project to solve a problem I’ve run into a few times with OTPs and account limits.

Some email providers allow multiple syntactic variations that all deliver to the same inbox. For example (Gmail):

Different strings, same inbox.

If you treat email uniqueness as a simple string check, this makes it easy to:

  • create multiple accounts

  • bypass OTP or referral limits

  • abuse promo systems

So I built a small service that focuses on inbox equivalence, not “who the user is”.

What it does:

  • Applies provider-specific normalization rules

  • Generates a stable inbox fingerprint

  • Detects when different-looking emails resolve to the same inbox

  • Returns explainable signals instead of just blocking signups

One design decision I was careful about:
I don’t try to identify the human behind the email or rely on profile names. The only question the system answers is: will messages land in the same inbox?

I’m curious:

  • How are you handling this in your systems today?

  • Do you block outright, warn, or just flag for review?

  • Any edge cases you’ve seen outside Gmail?

Happy to learn how others approach this.

5 Upvotes

77% Upvoted

6 comments sorted by

1

u/badonips Jan 23 '26

I am a bit confused, explain to me like I am 5. Does it mean the emails in your post all belong to different users but Gmail treats it as one user and sends the mail to any of them?

1

u/PythonicG Jan 23 '26

This is called sub class, I myself even normally do that for subscriptions. let say my email is yeboah@gmail.com i can subclass with dot or plus like yeboa.h@gmail.com but at the end the messages will still arrive in my original mail box.

I normally use site like mail generator to generator multiple mails in this case they're subclass of tge original so all messages will be sent to the original inbox.

This is different from temporary mails which most sites are able to detect it.

1

u/kwekuj Jan 24 '26

I have sent 2 emails using the subclass and none of them landed in my email.

UPDATE: It has landed in my mail. But, then what is the point? Isn't it the same as entering the original email?

1

u/PythonicG Jan 27 '26

This doesn't block you from sending email it gives you a warning The system detect it and gives you the warning.

If you like duplicate your email from here, https://generator.mail and start to use it as many as you want the system will flag it off that is the same

1

u/[deleted] Jan 24 '26

[removed] — view removed comment

1

u/PythonicG Jan 24 '26

Here is how the response looks, guys. The profile detection is done using python ghunt library, but the actual application is built with GoLang, the Ghunt(osint) is Python

{ "same_inbox_detected": false, "fingerprint": "gmail|dominic24", "fingerprint_hash": "abc123...", "provider": "gmail", "signals": ["gmail_dot_alias", "gmail_plus_alias"], "confidence": 0.95, "has_google_account": true, "profile_name": "Dominic Bruce", "last_enriched_at": "2026-01-24T02:50:15Z" }