It is getting quite deceptive, too. I feel bad for new npubs right now.
They can literally stop the spam right now by adding nip05-only mode on the relays.
NIP-05 is not verification, it's just a way to stablish DNS aliases.
But it can be Look at what Nostrudel does. I know right away it's fake http://blossom.poster.place/39daad20f564f961fc895c953e4da9604b029ea9c8a85998a682c47ff1eb7cdf.png
No. NIP-05 can't be where the identity lies. In #nostr the identity lies in the keypair (nsec+noun), not in the DNS alias. That being said, clients can chose different strategies to signal suspicious npubs, true. And some of them could be related with failing NIP-05 aliases? Could be. 🫂