Oof, this should've had #hottake in it - but, not wrong.
I verified myself with my own domain - one of the four I own anyway. But I did notice that there was a tendency for a lot of the spambots to use similiar domains to one another. This *could* be useful albeit I am not sure if it *should*...
However, to find a user's NIP-05, you'd have to look up each user off their post. I.e.:
[kind:1 Post].pubkey -> (Create a wss sub + filter for this pubkey) -> [kind:0 Profile].content -> JSON.parse(content).nip05.
It's not that many steps, especially with profile cachers like rbr.io (Iris uses that) but would be quite some work. Because now, each time you hold a post, you have to look at the NIP-05 and then decide to show or hide it - and you can't exclude it via wss filters either unless the respective relay happens to support additional syntax for it, which is very doubtful.
As said, quite the material for thought, but likely not easy.
nostr:note166flpypyxsx0xs8230kxh4mn6pfsrpptszpu7jwwha0nhqtgslasr3ma4e