System usernames form the core of any blocklist. These include admin, administrator, root, system, api, www, ftp, mail, localhost, null, undefined, true, false, and test. Some platforms block variations like admin1, admin2, and xadmin. Others use pattern matching to catch any username starting with "admin".
Support and help terms need blocking to prevent customer service impersonation. This includes support, help, helpdesk, contact, feedback, billing, sales, info, and care. Attackers regularly use these handles for phishing — they message users claiming to be from support, then steal credentials or money.
Security-sensitive terms like login, signin, signup, auth, authenticate, password, secure, verify, and confirm should never be available as usernames. These terms appear in phishing URLs and social engineering attacks. A handle like @verify looks official and tricks users into clicking malicious links.
Infrastructure and technical terms round out the blocklist. This includes terms like server, database, backup, cdn, cache, static, assets, upload, download, file, image, and video. While these might seem less dangerous, they can cause routing conflicts and confuse users about official platform resources.