[FearlessWeeder]

They're out of the Netherlands. Somebody is mirroring or or doing what ever those people do.

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 92.0.0.0 - 92.255.255.255
CIDR: 92.0.0.0/8
NetName: 92-RIPE
NetHandle: NET-92-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: SUNIC.SUNET.SE
NameServer: NS3.NIC.FR
NameServer: NS-EXT.ISC.ORG
NameServer: NS.LACNIC.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 2007-03-27
Updated: 2007-04-03

# ARIN WHOIS database, last updated 2009-01-07 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

--------------- Added [DATE]1231460406[/DATE] at [TIME]1231460406[/TIME] ---------------

I've done a little bit of reading. What about blocking them at the root?