Same for us. The ones I saw were all ads for some ed-tech software.
I started with that, but they were spawning so quickly, it was more effective to suspend all the identifiable accounts and turn on account approvals for now.
Since I’m reviewing all new accounts, I also caught on to a new set that concerns me – mostly fldubai.com domains (plus a few grr.la , pokemail.net on the same IP addresses). Started at a trickle, but picking up speed.
