Following up from:

In T357778#10095552, @kostajh wrote:

scenario	task
the user's IP is linked with X number of temp account creations in the last Y minutes	new task needed to create an AbuseFilter variable for "IP linked with {threshold} account creations in {threshold} time"

This task proposes to create an AbuseFilter variable that tracks the number of temporary account creations from a single IP address in the last hour (to be clarified: maybe a different time span is preferable). (n.b. T374522: Create AbuseFilter variable for number of temporary account edits in the last hour from an IP is like this task, but tracks temp account *edits*.)

The idea being that an AbuseFilter author could write something like temp_accounts_from_ip_in_last_hour > 1 and then set a showcaptcha condition, for example, to deal with suspected bot edits.