Rich subdomain blacklist should do the trick. Or alternative is: .app.mydomain.com or .mydomainapp.com Eventually require customers to have at least 4 character

Rich subdomain blacklist should do the trick. Or alternative is: .app.mydomain.com or .mydomainapp.com Eventually require customers to have at least 4 characters names.