We're seeing some signups on our application through emails like irmarussell.68486@gmail.com. All of them use the same format - <firstnamelastname>.<random5digits@gmail.com>. Anyone has seen these before?

If you are seeing a LOT of these, then my first inclination is to think someone is running a bot. They are either creating users via your website or worse, directly through your API. If you don't already have captchas, you'd want to start with that first. If you already had the V3 Google captcha (invisible ones), then you should make sure you are checking the score on the backend before creating the user. Usually, you'd send an email to verify the email if the score is low -- but that is more development overhead. The other thing would be to switch to the V2 Google captcha version in which people need to click on a checkbox and select boats or something to get through. That would require less dev effort on your part (I am guessing here because I have only dealt with V3 so far). If you are using Google Captchas correctly already, then I'd just change my sign up flow a bit. One option is to just take the email and send them an email to complete the process. Breaks the flow a bit but if you are getting a LOT of these, then might make sense. (You didn't share which application, so I am just sharing all the things I think might be happening).

@loud-glass-33663 thanks for the tips about captchas. We don't have it already, and we would implement it. I should've mentioned some more details. This is happening on our Android application and the signups are happening through Google Auth.

This is happening on our Android application and the signups are happening through Google Auth.

Ah ok. That is interesting. Google Auth means they are logged in and then signing up which is as good as having captchas I think. Though I have very limited experience with Android apps.

Bots. Definitely bots. Related: https://twitter.com/cvrajeesh/status/1462258732356624387

What baffles me is that all these bots have legit Gmail accounts that they are using to sign up. I can hardly do a better job keeping them out than Google.

What about mandatory 2FA for 'suspicious' accounts like these during the sign up process?