Thanks for the explanation. Yeah, many domains being required probably is annoying / prohibitive enough to stop distributed botnet attacks.

I’m actually not sure how federated lemmy hasn’t already been destroyed. Wouldn’t it just take one bad actor to start spamming all the other instances with nonsence? If you deferate with the instance the bots are coming from they can just open another, right? Like a DDOS attack