Put your site behind cloudflare with geo and bot blocking should eliminate the vast majority of them.

Yeah, Cloudflare is a good idea, that should probably help block them before even getting to the site.

This is not an answer to your question but existing sanctions should allow you to configure your application to reject any email addresses that use the .RU TLD. Not a long term fix but may buy you time to configure restrictions on the front end whichever direction you decide to go.

For clarity:

Do you mean "I want to block incoming spam email to my email addresses" or "I operate an email mailing list and I want to block bots from joining the list" ?

I mean I run a SaaS and get many fake registered users / bots.

What I did for now is:

- Added a honeypot field (invisible to users, but bots might fill it) -> if it's filled, instant reject - Added a check for spammy domains -> if it's from such a domain, instant reject

Honeypots may be skipped by bots. My simple solution to this is to create an input/text field in the account creation form, add a placeholder text "I am human" and ask the user to enter what they see (i.e., placeholder text). I've never received any fake/spam account since I incorporated this technique.

This is smart. Are there scenarios you've noticed that it doesn't work?

I've just added it :D

But I would guess that there will be new domains that I don't have in my blocklist and then I need to add them again and I would like to have this as a crowdsourced effort.