This is a CONNECTION issue, not a spam file issue, that's old and the files are easy to spot because they are small.

If you have a connection list, you will see a lot of connections to the same IP but different ports.

You will see a lot of connection attempts that will fail, and the list will show the same IP over and over with different ports going up in number sequence, or close to that.

These connections do not return search results at all, they "surround" your node and give you nothing! They prevent you from searching.

The attackers are counting on the fact that most of these "clients" out there hide the connection list because user's think it's booring to look at.

These nodes will drop off for lack of activity if your client does that, but then a bunch more on different ports come on and you are stuck.

You have to block these IPs and it's not easy.