Sign-up burst finder: spot bot sign-ups from the timestamps
In short: Upload sign-ups with an Email column and a time column. Runs of sign-ups packed into a short window are marked as bursts, copies of one mailbox are flagged, and you download the flagged rows or the rest. Limit: It reads times and addresses only; a burst is a signal and not proof of bots.
Upload your sign-ups with an Email column and a time column. You set a window in minutes and how many sign-ups make a burst, and the tool marks every run that packs that many into the window, showing its time span and most common domain. It also flags plus-tag and Gmail dot copies of one mailbox, and splits the list into flagged rows and the rest.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sign-ups this close together count toward a burst.
At least this many inside the window.
Sample result
Ten example sign-ups: 1 burst of 6 and 2 copies of one mailbox.
- Bursts found
- 1
- Rows read
- 10
- Copies of one mailbox
- 2
What this means for you
Six sign-ups in three minutes from one domain is worth a look before you send.
- Window and size you set
- Domains in each burst
- Plus-tag and Gmail dot copies
- Flagged rows or the rest
- Sign-ups
- Bots
- Lead list
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
Bursts set aside, now check who is left.
- Download the rows without flags, or use the check button under the result.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I find bursts of fake sign-ups?
- Export the sign-ups with their time as a CSV or .xlsx, or paste the cells with the header row first. It needs an Email column and a column of dates and times.
- Set the window and the number of sign-ups that make a burst. Press Find the bursts.
- Read the table of bursts and download the flagged rows, the rest, or the whole list with a burst column.
- Check the rest before you send.
Example
- You enter
- Example list of ten sign-ups with the window set to 10 minutes and 5 sign-ups making a burst: six on example.net within three minutes on 3 Nov 2026, and four spread over other days, two of them ben+a@ and ben+b@ on example.org.
- You get
- Ten rows read: 1 burst of 6 sign-ups between 14:02 and 14:04 UTC, all on example.net, and 2 rows that are copies of ben@example.org.
- Limits
- Runs in your browser. Times without a zone are read as UTC.
What counts as a burst?
A burst is a run of sign-ups where at least the number you set fall inside the window you set, for example five sign-ups in ten minutes. Overlapping windows join into one burst. Each burst shows when it started and ended, how many rows it holds, how many domains and which domain is most common.
Times without a zone are read as UTC, so the result is the same wherever you run it.
What are copies of one mailbox?
Plus tags (name+a@, name+b@) and, on Gmail, dots in the name (na.me@ and name@) all reach one inbox. Several sign-ups that collapse to the same mailbox are flagged so you can keep one. To normalise Gmail addresses on their own, use the Gmail address normalizer.
What does a burst prove?
Only that sign-ups arrived faster than you said was normal. A launch or a newsletter mention can cause one too. Use it to decide which rows to look at first, and read how to stop fake signups for the next step. To flag made-up addresses by their text, use the fake email checker.
Who uses this tool, and for what?
- Newsletter owners
- Find the minutes when a bot filled your form, before you send to them.
- SaaS teams
- Mark trial sign-ups that arrived in a burst so they are looked at first.
- Sales ops
- Separate a flood of form fills from ordinary leads.
What can’t this tool tell you?
- It reads times and addresses only; a burst is a signal and not proof of bots.
- Real traffic from a launch or a mention can look like a burst.
- Times without a zone are read as UTC.
- Only plus tags and Gmail dots are treated as copies; other providers' aliases are not.
Common questions
- What time formats can it read?
- ISO-style dates and times such as 2026-11-03 14:02:10 or 2026-11-03T14:02:10Z, plain dates, and Unix timestamps in seconds or milliseconds.
- What window and size should I use?
- That depends on your normal traffic. Start with your busiest ordinary hour and set the window and size above it.
- Will a launch day show up as a burst?
- It can. A burst only says the sign-ups were close in time, so look at the domains and addresses inside it.
- Why are plus-tag copies flagged?
- They all deliver to one mailbox, so the same person may have signed up several times.
- What happens to rows with no readable time?
- They are left out of the burst check and counted separately.
- Is my list uploaded anywhere?
- No. It is read in your browser.
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.