I have the application process enabled for people to join my instance, and I’ve gotten about 20 bots trying to join today when I had nobody trying to join for 5 days. I can tell because they are generic messages and I put a question in asking what 2+3 is and none of them have answered it at all, they just have a generic message.
Be careful out there, for all you small instance admins.
One recommendation-
I did just publish a few SQL queries to ASSIST in tracking down bots. They are located at THIS POST.
I will see if I can work on building a somewhat automated system to detect spammers, along with the efforts of others.