Yes, I found out the attacker was buying links. One site was offering links for a monthly fee. After I got removed from that one, about 1000 were gone. So he is using multiple link farms