Please. Captcha by default. Email domain filters. Auto-block federation from servers that don't respect. By default. Urgent.
And yes, to refute some comments, this publication is being upvoted by bots. A single computer was needed, not "thousands of dollars" spent.
Wait what's the difference between the suggested auto block and you historically blocking instances without applications? Is there other criteria you use to determine the block?
Not saying I know the answer, just curious.