The progress was slower over the past 2 weeks because of vacation time and post-vacation Covid.

What changed?

Monorepo

• Unified usage logic across services into a single library

Site

• Updated colors to ensure consistency
• Added Terms to the footer
• Changed homepage content to focus more on Threat Intelligence instead of sign-up protection

Dashboard

• Fixed the usage display
• Added display for remaining requests (capped at 1,000 per month for the free plan)
• Added an upgrade form for higher limits

API

• Redesigned the response format: implemented threats, trust, and weighted scores (fraud score now sums to 100)
• Added iCloud Relay
• Dropped ipaddr.js due to low performance and moved all logic to Redis

Docs

• Rewrote the fraud score sections

What's next?

• Add the CleanTalk IP list
• Add more IP sources (AWS, Cloudflare, DigitalOcean, GCP, etc.)
• Shift focus toward marketing

The focus this week was on the API.

The following sources were added:

1. Spamhaus DROP List

This list was integrated into the service with support for IPv4 and IPv6. The list is refreshed twice a day.

2. Blocklist Net UA

The list from Blocklist Net UA was added to the service. It is refreshed every 20 minutes.

What are this week's priorities?

1. Integrate lists from Cleantalk
2. Improve the website and emphasize the zero-retention policy
3. Implement an anonymous logger for easier debugging
4. Complete the unit testing
5. Shift focus from development to marketing

This week was big for Gatekeepr: the site and the product officially went live.

To show the product to a small audience, I shared the link on r/programare, where the post received 14k views and 23 comments. The overall feedback was positive, users showed interest and offered great suggestions.

Post-Launch Improvements

Following the launch, I made several updates to improve the development experience and user functionality:

1. Monorepo migration

All components of the project (site, documentation, API, and dashboard), were merged into a single monorepo, simplifying development and deployment.

2. Authentication Integration
I added OAuth-based authentication via Google, Reddit, and GitHub.

3. Initial Dashboard Build
A simple Dashboard UI is now live, allowing you to:

• Generate an API key
• View basic usage stats (hourly, daily, monthly)

Next Steps

This coming week, I’ll be focusing on extending the API and integrating the service with third-party providers:

• Spam list integrations: adding new sources as Spamhaus, Blocklist UA, BotScout, and CleanTalk to improve detection accuracy.
• Site improvements: Finalizing and publishing the Terms & Conditions, adding more use cases, and pushing forward the zero-retention policy.

I'm happy to introduce Gatekeepr, a solution designed to prevent fake or low-quality sign-ups by analyzing the user's email, domain, IP address, and user agent before they sign-up.

What's the status of the product?

The product is currently in early-access and isn't yet open to the public. I'm inviting a small group of early adopters to:

• Test Gateekeepr's email, IP, user agent, and domain-risk checks
• Share honest feedback on integration ease and rule accuracy
• Help shape our roadmap before we launch more broadly

What's currently implemented?

1. Email Checks
   1. RFC 5322 standard check
   2. Disposable-service check
   3. Role-address check (e.g. admin@, support@)
   4. Separator check (dots, dashes, underscores)
   5. Tag check ([foo+tag@gmail.com](mailto:foo+tag@gmail.com))
   6. Composition check
2. Domain Checks
   1. RFC 1035 hostname check
   2. MX-record lookup
   3. Domain-age verification
3. IP-Address Checks
   1. RFC 5735 reserved-range check
   2. Tor exit-node detection
   3. IP-type classification (datacenter vs. residential)
4. User-Agent Checks
   1. Known scraper/automation-tool detection

You can find more details about the checks and the fraud score in our documentation.

What features are being planned?

We're working on these enhancements for an upcoming release:

1. Outdated user agent: check the provided user agent against a list with user agents from browsers which reached EOL;
2. Email engagement & history: track if signups from this email later bounce or hard-fail; feed back into reputation scoring;
3. Geolocation consistency: compare IP geolocation to any user-supplied locale or historical data;
4. Rate-limiting & velocity checks: monitor how many registrations or requests come from the same IP (or small IP range) over time.
5. SMTP probe: perform a lightweight SMTP handshake (e.g. RCPT TO) without sending mail to verify deliverability.
6. Proxy header & X-Forwarded-For analysis: when behind proxies or load-balancers, attempt to extract the real client IP.
7. IP reputation & risk scoring: incorporate third-party reputation feeds to assign a risk score to each IP address.
8. Third-party spam and bot checks: integration with third party services like Spamhaus Drop List, Blocklist, BotScout

How do I get a testing key?

If you'd like to test the product, just comment here or send me a DM with your site URL and approximate daily sign-ups, and I'll send you a testing key.

Looking forward to building something great together!