signup.suspicious_name
The name contains a URL, an email address, or a long run of random-looking consonants.
What it looks at#
Send the name field as name. The check fires when it contains a URL or a host.tld domain
(www.cheap-pills.com), an email address, or a Latin-script word with seven or more
consonants in a row (asdfghjkl) or no vowels at all from five letters up.
It is built to leave real names alone. Words in non-Latin scripts (王伟, 山田太郎, Иван,
يوسف) are never examined. Short or consonant-heavy real names pass: Ng, Nguyễn, Sjögren,
Krzysztof Wojciechowski, Szczepański, Mkhize, O’Brien, Jean-Luc, Mohammed bin Salman. A
name typed as john.doe reads as a domain and fires.
Why it matters#
Spam signups use the name field to carry links, and lazy bots fill it with keyboard mashing.
What to do#
Low severity, and a heuristic: treat it as one weak signal among several. The finding message never repeats the name.