A sophisticated spambot operating under the email address ph******@*********ls.my became one of the most active threats in late 2025. Since its discovery on November 10, 2025, this automated attacker has spammed 11,428 websites, with the last recorded activity being December 15, 2025. The CleanTalk anti-spam service currently blocks approximately 9,048 requests per day from this single email address—that’s over 375 spam attempts every hour.
Unlike obvious spam, the messages mimic legitimate customer support requests, making them difficult to detect without advanced anti-spam protection.
Spam Messages Used by ph******@*********ls.my
This bot sends seemingly mundane questions about service offerings, appearing to be from potential customers:
- “Is there a referral program?”
- “Do you offer maintenance plans?”
- “Do you work weekends?”
- “Can I pay with PayPal or other methods?”
- “Do you offer support after purchase?”
- “Do you offer consultations over Zoom or phone?”
- “Do you offer recurring service plans?”
- “Do you offer service in rural areas?”
- “Can I pick up instead of delivery?”
- “Can I get a service checklist after the job?”
- “Can I get a quote by text or email?”
- “Do you offer financing through a third party?”
It’s very difficult to tell if a message is spam based on its content. This poses the risk of you replying and having your email harvested by spammers. It’s hard to say how they’ll use it, but it’s safe to assume it could be used to send spam to websites or to try to gain access to your website account.
How to Block Spam from ph******@*********ls.my
If you’re seeing traffic or spam submissions from this email, here’s how to stop it:
1. Use CleanTalk Anti-Spam Plugin
Install the CleanTalk Anti-Spam plugin for your CMS (WordPress, Joomla, Drupal, etc.). It automatically filters requests by checking emails, IPs, and behavior against the global CleanTalk Spam Database.
This email is already blacklisted and will be blocked automatically by the plugin.
2. Manually Block the Email (if needed)
If you want to block it manually in addition to using CleanTalk:
Add ph******@*********ls.my to your site’s block list.
Block common IPs that were used in attacks.
Monitor your server logs for repetitive POST requests.
******@*********ls.my” target=”_blank” rel=”noreferrer noopener”>ph******@*********ls.my is a known spammer attacking thousands of sites daily. By installing proper anti-spam protection like CleanTalk and staying vigilant, you can block these threats before they reach your visitors.
If you’re already using CleanTalk, rest assured — this spammer is on the blacklist and will be filtered automatically.
You can check any email or IP for spam activity on our BlackLists page.
🧩 Want full protection?
✅ Blocks fake registrations and spam submissions
✅ Filters bots and fake emails in real time
✅ No CAPTCHAs or puzzles – clean and fast
Stay ahead of spam – let CleanTalk handle the bots so you can focus on your content. Protect your site in under 5 minutes.
👉 Start now
**************@
