This is the second edition of our monthly tracker highlighting email domains linked to fraudulent activity. Just like in April’s report, our goal is to equip security and anti-fraud teams with greater visibility into the email infrastructure commonly exploited by bots and fraudsters.
What this list includes: The domains featured here are those observed in connection with fake account creation and other abuse patterns. These fall into three primary categories:
- Known disposable email services
- Custom “throwaway” domains registered specifically for fraud
- Legitimate free email providers with limited anti-abuse protections
Update: For the May edition, we refined our list generation process to exclude typosquatting domains that mimic legitimate providers (e.g., gmial.com, outlok.com). While these are frequently used by bots, they’re also common user mistakes and don’t always signal fraud.
Why we’re publishing this
Most open-source intelligence on email abuse focuses only on known disposable inbox providers. These lists are often compiled by scraping public sites that promote temporary email services. But this approach overlooks large swaths of abuse.
Because Castle protects real-world websites and apps at scale, we see a much broader picture, including custom throwaway domains that attackers register for specific campaigns. These domains rarely appear on public blocklists and are often used for short bursts of activity before being discarded.
By sharing the domains we’ve observed, we aim to help fraud teams expand their visibility into attacker infrastructure and detect threats earlier.
How to use this list
This dataset is a signal, not a blocklist. We don’t recommend banning these domains outright. Instead, use them to inform risk scoring and layered defenses. For instance:
- Reduce thresholds for identity or behavioral verification
- Combine with device fingerprinting or traffic patterns to increase confidence
- Monitor for spikes in use of newly registered or low-reputation domains
The list below includes 218 domains, sorted by volume of malicious activity observed, highest to lowest.
grr.la
guerrillamailblock.com
vafyxh.com
svk.jp
cs.com
vwhins.com
wyoxafp.com
zudpck.com
zvvzuv.com
qzueos.com
mrotzis.com
emlhub.com
boxfi.uk
fxavaj.com
mozej.com
bltiwd.com
nespf.com
skyelaf.com
mailna.co
oegmail.com
svipely.com
illubd.com
qejjyl.com
qacmjeq.com
enotj.com
jxpomup.com
ibolinva.com
dbmail.com
mkzaso.com
daouse.com
smykwb.com
drmail.in
haren.uk
hthlm.com
tansbike.com
nesopf.com
jkotypc.com
osxofulk.com
maildrop.cc
juno.com
wywnxa.com
nbmbb.com
thetechnext.net
sharklasers.com
telegmail.com
bcooq.com
logsmarter.net
hi2.in
gmail10p.com
azuretechtalk.net
poplk.com
netscape.net
polkaroad.net
yanemail.com
ytnhy.com
fabricoak.com
knmcadibav.com
dreamclarify.org
deliverydaily.org
uorak.com
dygovil.com
tidissajiiu.com
mailto.plus
bigmir.net
asciibinder.net
magneticoak.com
via.tokyo.jp
ptct.net
byom.de
gufum.com
tuamaeaquelaursa.com
ancewa.com
hacoi.shop
ngocquan.tech
toidibay.tech
mongrec.com
jmail.com
ingitel.com
atminmail.com
wildbmail.com
miracle3.com
hedotu.com
letterprotect.com
astimei.com
atorymail.com
cyluna.com
streetwormail.com
npo2.com
ronaldofmail.com
corporate.vinnica.ua
eblanomail.com
e-mail.com
chiefmail.kr.ua
privateemail.uz.ua
123gmail.com
mailinator.com
panvli.com
jioso.com
tubermail.com
all4g.ru
difficilemail.com
bolivianomail.com
regardermail.com
demainmail.com
reahla.com
utiliseremail.com
mail.io
mmkeys.ru
fivemhq.online
fivemfresh.uhq.helioho.st
edny.net
quieresmail.com
gemil.com
estabamail.com
yeserica.com
puedemail.com
protcapplication.shop
emaily.pro
dynamicgaming.cloud
earthrockies.xyz
fivemx.shop
deoxidizer.org
nrimall.com
naihev5.vip
zdzq88.cn
perc30s.org
allgrounder.com
yopmail.com
ijmgamershopemail.com
vierasigma.shop
5mready.org
unbanneds.shop
chefalicious.com
unselected.email
wirelicker.com
bokomail.shop
lostspaceship.net
homingpigeon.org
whyusoserious.org
rocketpost.org
paradox5m.net
kakdela.net
emailclub.net
2mails1box.com
spacemail.icu
desumail.com
lettersboxmail.com
300bucks.net
energymail.org
fivemcheaps.store
cheesemans.quest
shroudedhills.com
myhyperspace.org
fivemready.shop
postalbro.com
writemeplz.net
dcpa.net
yesreply.online
sweetdoggo.xyz
fivegen.fr
cheaprsgolds.icu
fivemrockie.eu
lorranboss.shop
fivemquality.online
momoxontop.com
phgm52.cn
zangaofc.xyz
outlo0k.com
5maccounts.com
michaehost.in
trevorhost.in
franklinhost.in
lesterhost.in
gamerspace.online
gamershubcloud.com
wptapps.com
qinianstm.com
n-xs.eu
bilola.shop
miruna.lol
pivete.shop
schizololi.help
honeypie.store
outiloook.xyz
outlo0k.online
p1177.net
hfdafkfcdbu.shop
galaxygas.cc
longlx.xyz
maiorfornecedor.com
sexintens.cam
id-kirby.usersinbuckets.com
