How detection works
Randomness classification
Local parts are classified low, medium, or high randomness based on multiple independent shape checks.
Vowel-ratio & consonant-run analysis
Catches strings that don't read as words or names, above a minimum length to avoid false positives on short real handles.
Digit-placement analysis
Distinguishes a benign trailing year suffix (sarah1987) from digits interleaved throughout the string.
Keyboard-pattern detection
Flags keyboard-adjacent sequences like qwerty or asdfjkl, checked forward and reversed.
Repeated-fragment detection
Catches generation patterns like abcabcabc123 that tile a short fragment through the string.
Shannon entropy
A supporting randomness metric reported alongside the shape signals, not used as a standalone trigger.
Example request
curl https://api.emailriskradar.com/v1/email/check \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{"email": "xkqbzv847@example.com", "context": "signup"}'FAQ
No. "Unusual" and "risky" are tracked separately — a mildly odd but harmless handle shows up in the descriptive analysis without triggering a risk signal.
No detection method catches every case. These signals catch the large majority of naively-generated addresses, which make up most real-world abuse traffic.
No — detection works on the shape of any string, including ones never seen before, which is necessary since abusers generate new addresses constantly.
No — they're independent checks. A random-looking local part on a legitimate domain, and a normal-looking local part on a disposable domain, are both flagged for different reasons.