Looking at vandal accounts used in ongoing attacks, many of them were registered some time before edits and have quite distinctive user names (due to vandal creating thousands of them).
Is there somewhere list of all registered OSM accounts? I hope that I could look through a list and suggest account to block before they are used in attack.
To answer the question: no there is no public list of all accounts.
Note that you can generate a list of all accounts that have opened a changeset, but that was not the question.
I think we’ve mostly done that. All of the users used for recent waves of this sort of vandalism have been new accounts. Previously, this vandal had accumulated accounts over a long period of time this month and last month, and had been using those, but I think that list is all blocked now. The admins did a similar job for the last big wave of vandalism a few weeks ago (that was where the “7000 accounts blocked” figure came from).
Yes, we are doing that.
Doubtlessly there is a filter way to isolate ‘sleeper’ accounts. A pattern of who is and who isn’t would be a painstaking effort no doubt. Accounts that never had transactions I’d delete or perma block, Cleans up the DB too and if someone gets marked in error it’s be in good faith and easily recreated if need be.
Most likely, you do not need all accounts, but only newly created ones. Such a list is easy to generate using the OSM API knowing that users have IDs and they are always increasing