When speaking about the recent mysterious massive spambot attack on #fediverse, it tends to spread hybrid Russian war and political propaganda tailored to languages corresponding to given TLD. But the propaganda part is suspiciously mild, uninteresting and self-repeating - so it actually may be even just systematic nuisance effort, only masking as propaganda. Who knows.. I am no counter-espionage expert.
It may help to to cooperate and share lists of banned mailservers, from which they registered new accounts. I can contribute already more then 10, soon more. All of them are in .com TLD. Even if they have thousands of them, it should be still possible to create blacklist. But I am not sure, if more mail domains can be imported to Mastodon moderation backed at once...
At first, they were reusing IPv4 addresses and mail domains, but when they figured out, that double registrations from weird .com domains and exotic IP pools are extremely suspicious and immediately lead to bans, they no longer reuse mail domains.
In a way, this seems to be worse, than Nicole, the Fediverse chic. Although the random sequences of syllables (LLM tokens?) used as TLDs and .com domains create pattern, which can be somewhat recognized after some time, #mastodon moderation backend does not provide any useful way to automate this.
Closing registrations won't help, because before bots start doing their bot thing, you are never 100% sure, what you are banning. Someone clearly intends to force #Fediverse to switch to invite-only mode, but I don't want to subdue.