Your cloud AI sandbox platform offers $50 of free GPU compute credits to new users upon email verification. Fraudsters build automated scripts to claim hundreds of thousands of free accounts, burning through hundreds of thousands of dollars in cloud infrastructure to mine cryptocurrency and run illicit batch compute jobs. To prevent automated multi-accounting, the team banned disposable temporary email providers using a static open-source blocklist of 3,500 disposable domains (`mailinator.com`, `10minutemail.com`, etc.). Within two days, the fraud rate climbs right back to peak: the attackers register custom cheap top-level domains (`.xyz`, `.top`, `.online`) for$0.85 each, pointing the DNS MX records to disposable email hosting backends (like Mailgun or custom catch-all Postfix servers). Because the domains are brand new, they do not appear on any public blocklist. The database fills with 120,000 fake accounts, cloud compute bills surge by $180,000, and outbound verification emails sent to dead catch-all inboxes cause AWS SES to throttle your email sending quota. You are asked to design a real-time email verification and disposable domain intelligence architecture that identifies ephemeral throwaway domains dynamically.