@MastodonEngineering Thanks for raising this, we're dealing with the same wave of spam signups on our side. We tested a soft captcha at registration, but it doesn't trigger reliably every time, so we still end up manually blocking somewhere between one and five accounts a day regardless. We also tried a hard captcha on every signup, it does cut down spam, but it noticeably discourages real people from registering too, so it's not really a clean tradeoff either.

What we're running now is a different approach on the server side, a local model that runs on a schedule every couple of hours and checks new accounts for spam signals. If something looks off, the account gets frozen, and then once a day we manually review whether it's a real person or a bot and unlock or remove accordingly.

Not a perfect solution, but it's keeping things manageable for now. Good luck to everyone dealing with this.