btherl - 3:34 am on Jul 4, 2012 (gmt 0)

I block this one by referrer, there's just no other way. It appears to be related to this:

[sub0day.com...]

Sometimes there's an ip address, sometimes a hostname. Since it's a botnet the IP changes constantly.