Damn!! That solves a riddle that has been bugging me the last two weeks or so! I'm in the same boat as OP (not a blog, but a web app, https://cubetrek.com http

Damn!! That solves a riddle that has been bugging me the last two weeks or so! I'm in the same boat as OP (not a blog, but a web app, https://cubetrek.com https://cubetrek.com). I've received the same type of account registrations (gibberish username, valid email address) since two weeks. My web app sends out an account verification email, so it makes total sense. I've recently integrated Cloudflare Turnstile as captcha alternative, but the automated sign ups have not stopped (they just get ignored server side). I'll probably have to change the endpoint address as well. Since I'm receiving a dozen of apparently compromised email addresses every day, is there anything I can do? Informing the user via email is obviously not very practical. Not to give the bad actor any ideas, but why don't they use some fake names instead of gibberish? It would be less obvious.