Because spammers are dumb, they keep trying the same thing over and over. But they tend to slightly vary from day to day. If you’re using mod_security to block them, you might like to occasionally look at my blogspam_rules.txt file that I’m Includeing into my vhost configs, updating it each time there’s a new attack mounted. It appears that the attack du jour is debt consolidation.