@tante@tldr.nettime.org the two most used domains today were docomo.ne.jp and yahoo.co.jp, but some came from gmail.com, which I don't want to block from obvious reasons. But the pool of IP addresses owned by japanese companies is interesting. They are not listed as TOR relays and not on two different lists of malicious IPs. Which is interesting, because until recently, all offending IPs were on existing blocklists... eg. 112.137.217.112, 180.33.136.3, 164.70.160.7, 180.145.210.89 and 60 others. If Fediverse moderators could easily federate the blocklists - maybe Mastodon already exports the IP blocks via API? - we could really fence off the fake account attacks and stay open.