I have more data! Here are the top-level email domains used by people (?) registering on my blog recently:
Before December 28, everything was normal. It was mostly .com addresses with a smattering of oddball TLDs.
Starting at precisely 11:30 am on December 28, that changed. Normal sites now make up only a quarter of registrations. The rest are .top, .site, and a few other oddballs.
According to Wikipedia, .top domains "are often used for malware and phishing, and is included in the list of banned TLDs for some antimalware venders (i.e. Malwarebytes)."
Wikipedia doesn't mention anything noteworthy about the current reputation of .site other than the fact that it's owned by a company that's owned by a serial entrepreneur billionaire. However, every single .site address is of the form
name12345@lhfye.site
The numbers are random and there are five domains being used: lhfye, injis, nniks, scekd, and wgwpyi.
So this is obviously being done by bots or something similar. But why? And is there anything I can do about it?