What is going on is that a large scale form/search spam botnet has rather aggressively gone after multiple sites on the shared IP, a number of them under one user and linked together. Then they are massively submitting all kinds of 'search spam' (which can be seen in the logs) with just all kinds of crazy queries in any form that is open at all, mail form, search a site form, etc. Also anything like this is getting a massive amount of POSTs from the same bots for if it is allowing a submission of these queries, that is why it is going perl/php/asp/asp.net etc. This is normal and to be expected on a small scale but this is quite a large scale of it and when you close one area, it comes back with a new. We've made good progress and found the best place now to keep up with the latest attempts.