Why are people named 'yHKywZgctmBccWRFof' signing up for my app?
Noticed a weird pattern in my user signups - half the names looked like someone had a seizure on their keyboard.
At first I thought: broken form? Encoding issue? Cats walking across laptops?
Nope. Bots. Lots of them.
Plot twist: some were actually VERIFIED accounts. They were clicking email links and everything.
Turns out even compromised email accounts + automation = people too lazy to type "John Smith" 😅
Added some subtle anti-bot measures that real users will never notice. No annoying CAPTCHAs, no extra friction - just quietly watching for patterns that humans don't do.
The gibberish names are gone. The bots probably moved on to someone else's signup form.
If your analytics look weird, check your actual user data. You might be surprised what's in there.
I'm having the same issue on a couple of my websites. Curious what anti bot measures you used that don't annoy the users?
Bot traffic can quietly distort early SaaS metrics more than people realize.
I’ve seen situations where signup numbers looked healthy, but activation and conversion were misleading because automation noise wasn’t filtered out. It affects everything downstream CAC, funnel analysis, even product decisions.
I like your approach of minimizing user friction instead of throwing CAPTCHAs at everyone.
Curious did you rely mostly on behavioral signals (timing, interaction patterns, entropy in inputs), or infrastructure-level checks like IP reputation / fingerprinting?
Also wondering if you noticed any measurable improvement in funnel clarity after filtering them out?
This problem gets so little recognition. ~
While people are often obsessed with traffic and conversion rates, no one seems to care about whether the users are real.
I experienced a similar instance when my analytics seemed to be looking “healthy” steady signups, email confirmations, even some feature usage but revenue and feedback was crickets. It turned out that a large part was automatic junk which passed basic verification.
What you pointed out is the scary part: they will not always be obvious bots. Hacked scripts combined with hacked emails created human activity worthy of dashboards.
The true insight here is the transition from “add CAPTCHA” to “watch for patterns humans don’t do.” There is reduced friction and increased effectiveness.
What types of signals did you end up finding most reliable? What are the possible patterns here?
What were the anti-bot measures you added? I think this could be interesting for me to also add on my forms
This is a great example of why looking at real user data matters more than surface-level analytics.
I like the approach of adding protection without adding friction — most users never notice, but the signal gets much cleaner.