On Tuesday I received 423 emails from an unknown spammer attacking my site.
On Wednesday I received 789 emails from the same spammer.
Action had to be taken.
The emails were copies of posts to my discussion forum - the typical spammers posts - keyword stuffing, numerous hyperlinks to junk sites crammed with even more keywords.
It was clear I was being hit by one spammer, with an automated script, for a number of telltale reasons:
1) Nobody could post 789 posts to a forum in 24 hours manually
2) All posts were from random .co.za email addresses (South African domains, but likely false)
3) All posts pointed to very similar spammy sites obviously made with the same auto-generation software
4) Checking various domains promoted within these posts in WHOIS showed they were all owned by a certain guy in Paris
I carefully combed my forum for these junk posts but couldn't see anything out of the ordinary. So I checked for posts by .co.za email addresses, or French IPs but couldn't see a problem anywhere.
Where were they coming from, and where were the posts?
To help me in my quest I did a search on Google for the text that began every email which read:
