I’ve received approx 100 spams from that IP, and it was keeping coming until I’ve made a ”deny from 220.127.116.11” on the affected site. The affected system was Commenting System, a TYPO3 extension that allow people to comment on news.
The vicious spammer has harassed content providers at least eight months; I’ve found a blog post mentioned it as early as June 2009: timpanogos.wordpress.com/2009/06/03/can-anyone-stop-the-spam-from-94-102-49-76
Btw, I’ve found out a fun thing when I researched more about the offender. The address http://18.104.22.168/a-poster/ shows a login form, but if you omit the trailing slash, it 301 to the invalid domain http://www.b05s13.ams1/