awesome answer Ryan, thank you! We blocked the referrers IP but that does not seem to make any difference (yet).
Just puzzled by a site that has no apparent meaning and thousands of people must have a login to that thing. Maybe it is a reroute from somewhere else... no clue.
Will give your advice a go tomorrow and surely will let you know the outcome.
Peter