Two Bot Attacks on Our Signup: 29,033 Attempts from 7,857 Outlook and Hotmail Addresses

Between September 22 and October 28, 2026, one operator tried to open free ipapi.is accounts 29,033 times, in two attacks, with 7,857 Microsoft mailboxes and 6,335 IP addresses in 121 countries. 94 attempts got an account. This post publishes every attempt, with its date, IP address and email address, and what the data says about how the attacks were run.

	Attack 1	Attack 2	Both
Period	Sep 22 – 28	Oct 16 – 28	Sep 22 – Oct 28
Signup attempts	6,660	22,373	29,033
Email addresses	4,476	7,475	7,857
IP addresses	1,567	5,475	6,335
Countries	21	121	121
Networks (ASNs)	155	1,178	1,213
Accounts created	28	66	94

Two attacks, one operator

Attack 1 began on September 22 at 17:54 UTC and ran for seven days, at up to 1,433 attempts a day. Then the operator went quiet for eighteen days. Attack 2 began on October 16 at 17:57 UTC, reached about 2,500 attempts a day two days later and held that rate for eight days. On October 27 the operator switched to a different browser and carried on at a much lower rate.

Both attacks came from the same operator. They used the same browser build with the same configuration, and 4,094 of the 4,476 mailboxes from September (91%) came back in October. A mailbox was tried 3 times in the median and up to 80 times.

The browser

Until October 26, every attempt came from Chrome 146 on Windows 10 under remote control through the Chrome DevTools Protocol. The configuration never changed: 8 CPU cores, 8 GB of memory, a 1920×1080 screen, US English as the only language and no detectable system fonts. Only the graphics card did. It was always an NVIDIA GeForce RTX, drawn at random from 57 models that each turn up about equally often, so that no two attempts would look like the same machine. The mailbox names were English names, often with a few random letters or digits mixed in.

On October 27 at 17:26 UTC the operator moved to Camoufox, an anti-detect build of Firefox. It runs a real browser engine and changes the fingerprint inside the engine, so the page sees one consistent browser, a new one on every launch. It picks the browser language by how many people speak it in the proxy's country, which produced browsers set to Low German (nds-NL), West Flemish (vls-BE) and Bavarian (bar-DE). Most mailbox names were now Chinese names in Pinyin followed by digits. Camoufox created 11 accounts from 14 mailboxes before we stopped it; we do not describe here how. The last of them was created on October 28 at 12:54 UTC, and every one of its sign-in attempts was refused.

The IP addresses

92% of the 6,335 addresses belong to consumer internet providers. Comcast alone has 1,375 of them. These are residential proxies: networks that route traffic through home connections and phones, often without their owners knowing. In attack 1, 96% of the addresses were in the US. In attack 2 they spread over 118 countries, although 85% of the attempts still came from US addresses. 4,219 addresses (67%) were used for a single attempt. Camoufox ran through different proxies: 51 of its 97 addresses were in hosting networks and 55 in Hong Kong, Japan, Taiwan and Singapore.

An address in this list means that a signup attempt came from it at the time shown. It does not mean that the person whose connection it is took part.

The email addresses

All but one of the 7,857 addresses are Microsoft mailboxes: 6,815 on outlook.com, 1,025 on hotmail.com and 16 on regional Outlook domains. A Microsoft mailbox is not suspicious in itself; plenty of real customers sign up with one. What gave these signups away was the browser, not the address.

The exception is the very first attempt, on September 22 at 17:54:19 UTC, from test1790099639042@bravealias.com. The digits in it are a timestamp: 17:53:59 UTC that day, twenty seconds before the attempt arrived. It looks like the operator testing the script.

What got through

94 of the 29,033 attempts (0.32%) created an account: 28 at the start of attack 1, 55 at the start of attack 2 and 11 from Camoufox. The September accounts are banned. Of the others, all but the last were deleted, and the last one has never been able to sign in.

The data

Download all 29,033 attempts (CSV)

One row per signup attempt: date_utc, ip, email, attack, browser and outcome. Search it for an address or a mailbox:

How we counted

The attempts come from the logs of our signup server, which record the time, the IP address and the email address of every refused signup, and from the accounts that were created. Whether an attempt belongs to an attack is decided by its browser alone: Chrome 146 with the configuration described above, or Camoufox with an audio fingerprint that was identical on every launch. Not by the mailbox provider and not by the IP address. That left out 747 other attempts we refused in the same weeks, which we could not tie to these browsers, so the numbers here are a lower bound. Times are UTC. Countries and networks are from ipapi.is as of October 28, 2026.