Figured out the bot that is stealing all of the account creation tokens! I think. At least found a signature pattern that basically tags it as a headless Android device bouncing around VPNs.

Trying to do what we can to secure our account creation tokens for ACTUAL USERS!