A HEAD case

Here's a nice referrer spammer who tries to safe us some bandwidth - he's only sending HEAD requests.

autoclan.com (209.66.114.27), ebanon.com (209.66.114.21), egghoo.com (209.66.114.34), findteam.com (208.184.65.35), searchsure.com (209.66.114.20), and ticketsbot.com (209.66.114.27) are all registered to a RegetX Spolka
Bruno Diesenreiter (regetx@gmail.com)
ul. Dubois 117
Lodz
PL,93-465
PL
Tel. +48.422506983

The first five of those domains are registered with directi.com, while ticketsbot.com is registered with Critical Internet. findteam.com is hosted with APS Communications, the others with Abovenet. autoclan.com, egghoo.com, findteam.com, and searchsure.com have Google ads on them (Client id: pub-6794909634867765).

And then there's another domain, zakona.net, which is used to spam for the usual mix of pills. That domain is registered with namesecure.com for a DAVID TSUNG
3534 TRINITY STREET
EUREKA, CA US
95501

Unrelated? Nope. It's also hosted at Abovenet (209.66.114.22), spamvertized in the same way (HEAD requests only) - and it has Google ads with the same client id on it.

The referrer spam for zakona.net is also coming in from the same IP as for the other domains (80.77.86.237). Now the whois information for that IP rang a bell - Ann Elisabeth already caught them. I'd suggest following her advice and blocking their entire IP range.

This has actually been going on for a while now and there are more domains involved. But the above should be enough to identify which spammer this is.