1-99seo.com looks like a similar content spammer campaign, from South America/Brazil. The style is very similar to fix-website-errors-com by Semalt, which was really terrible.
1-free-share-buttons.com looks to be the same
It is these types of content scraper marketing campaigns that wastes the receiving web site’s bandwidth. They visit the same pages daily, scraping from multiple IP addresses.
Observations:
41-25-13-177.skybandalarga.com.br 1-99seo.com
179.253.158.29 1-99seo.com
177.17.112.14.static.host.gvt.net.br
bb17f055.virtua.com.br 187.23.240.85 1-99seo.com
189.114.176.255.dynamic.adsl.gvt.net.br 1-99seo.com
c925a0a7.virtua.com.br 201.37.160.167 1-99seo.com
net-93-67-243-247.cust.vodafonedsl.it 1-99seo.com
189-8-18-10.ded.rpbandalarga.com 1-99seo.com
badcc9d4.virtua.com.br 186.220.201.212 1-99seo.com
69.156.31.44 1-99seo.com
177.237.11.177.cable.dyn.cableonline.com.mx 1-99seo
203.87.133.153 1-99seo
69.156.31.44 1-99seo
wan.fastsignal.com.br 1-99seo could not track down but its dns is ns1.wtek.com.br 186.209.224.11
ns2.wtek.com.br 186.209.224.12, so I’ll ban both
189.19.128.77 1-99seo.com
182.48.64.186 1-99seo.com
177.70.83.91 1-99seo.com
179.235.54.111 b3eb366f.virtua.com.br 1-99seo.com
191.194.15.105 191-194-15-105.user.vivozap.com.br 1-99seo.com
177.155.185.118 177-155-185-118.servers.ricable.com.br 1-99seo.com
179.178.198.163 179.178.198.163.dynamic.adsl.gvt.net.br
1-99seo.com
187.55.178.95 187-55-63-154.jvece702.dsl.brasiltelecom.net.br 1-99seo.com
187.102.71.60 187-102-71-60.customer.foxinternet.com.br 1-99seo.com
77.237.112.82 1-99seo.com 2016-oct-05
189.24.156.163 189-24-156-163.user.veloxzone.com.br 2016-oct-06
85.245.114.200 bl12-114-200.dsl.telepac.pt 2016-oct-12
200.139.168.81 200-139-168-81.viacaboip.com.br 2016-oct-14
191.193.180.140 191-193-180-140.user.vivozap.com.br 2016-oct-16
91.101.242.116 91.101.242.116.generic-hostname.arrownet.dk 2016-oct-18
177.0.192.172 177-0-192-172.3g.brasiltelecom.net.br 1-99seo 2016-oct-31
187.13.93.22 187-13-93-22.user.veloxzone.com.br 1-99seo 2016-oct-31
197.249.129.205 cust205-129-249-197.netcabo.co.mz 1-99seo 2016-nov-01
187.16.54.162 IPE INFORMATICA Br 1-99seo 2016-nov-04
189.47.89.218 189-47-89-218.dsl.telesp.net.br 1-99seo 2016-nov-08
79.169.183.71 a79-169-183-71.cpe.netcabo.pt 1-99seo 2016-nov-08
41.242.136.28 Surfline 41.242.136.0 – 41.242.136.255 1-99seo 2016-nov-10
176.205.21.177 Emirates Tel 176.205.0.0 – 176.205.63.255 1-99seo 2016-nov-10
201.11.109.99 201-11-109-99.ccoce700.dsl.brasiltelecom.net.br 1-99seo 2016-nov-13
191.241.158.173 191-241-158-173.reverse.dstech.com.br 1-99seo 2016-nov-13
5.95.129.129 net-5-95-129-129.cust.vodafonedsl.it 1-99seo 2016-nov-17
177.52.24.34 1-free-share-buttons.com
93-35-185-25.ip56.fastwebnet.it 1-free-share-buttons.com 93.35.185.25
137.148.13.101 csu-ext2.csuohio.edu 1-free-share-buttons.com
152.250.63.134 152-250-63-134.user.vivozap.com.br 1-free-share-buttons 2016-oct-24
186.215.4.220 186.215.4.220.static.host.gvt.net.br 1-free-share-buttons.com 2016-nov-15
187.13.76.10 187-13-76-10.user.veloxzone.com.br 1-free-share-buttons.com 2016-nov-16
148.101.109.40 40.109.101.148.d.dyn.claro.net.do 1-free-share-buttons.com 2016-nov-22
177.55.95.249 249.95.55.177.conecte.net.br 3-letter-domains.net
Pattern:
They put their marketing campaign as the referrer for the first 2 GETs, and then use your site name for all subsequent GETS. If you simply ban the referrer then you will not know the identity of the campaign.