I have the application process enabled for people to join my instance, and I’ve gotten about 20 bots trying to join today when I had nobody trying to join for 5 days. I can tell because they are generic messages and I put a question in asking what 2+3 is and none of them have answered it at all, they just have a generic message.
Be careful out there, for all you small instance admins.
Detecting and blocking whole instances with many bots is somewhat trivial. Blocking and detecting some number of bots in an instance with 10k users, with an ever growing number of human users, is much harder.
Setting up an instance would be more difficult too I assume
It’s honestly not too bad, only took about an hour after researching a couple of days. There’s an easy deploy script out there, that I don’t have a link for on my phone, that makes it really easy.