The culprit referrer: 35iPaDcjQqViRkXXHnagGYoKGxvCpEmcZk
The referrer has a you tube account https://www.youtube.com/user/ARAMIC2007
Got his addy from here 35iPaDcjQqViRkXXHnagGYoKGxvCpEmcZk
Yea I saw that too... What is interesting is that every single account this person "referred" is also a multisig address. Typically I only see a few multisig addresses here and there, then all of a sudden every single person is "referred" by this guy and every single one also has a multisig address. No coincidence.
So he is using multiple addresses it seems, are the ips the same, if not he is very clever on changing it.
I could be wrong in my assumption though.