noticing a pattern with this new spam wave. because the profile picture is all the same file each time, you can find a list of accounts in your database that match the blurhash. on iceshrimp (and likely misskey?), the query would be select uri from "user" where "avatarBlurhash" = 'ysK_8.M{%MRj%LogkC~qofjut7t6t7WBogozs:ofWBaxaxM{NGofWBayayays:kCRkayayofWVsofPWBbHj[offks;t7t7ofWCayWB'; to get a list of all federated spam users if you want to send reports for any that void.rehab hasn't seen
most of the federated accounts so far have been bark.lgbt, but they are all already suspended. alive.bar hasn't suspended any yet and ruhr.social hasn't suspended the one account asking people to join a cult (!)
here are the urls from void.rehab:
bark.lgbt/users/yuqlggzkj
bark.lgbt/users/zffqjgzkj
ruhr.social/users/qysbdublj
alive.bar/users/chnmwlblj
alive.bar/users/ieboxlblj
alive.bar/users/fwxttlblj
bark.lgbt/users/vjzdggzkj
bark.lgbt/users/nckfigzkj
bark.lgbt/users/txnkkgzkj
alive.bar/users/jinxtlblj

this is why you don't do open signups without approval by the way