These guys are morphing their MAIL FROM: domain pretty rapidly, so into the IP list they go. I started with a /32, but an examination of my records suggested the entire /26 should go in, and so it has.
In this particular case, the spam is being sent to an address harvested from Network Solutions domain contact information; Phil Frontino is the New York Region SCCA Treasurer, and he had no email when we registered that domain, years ago, so my email address is in there instead of the one he didn't have.
Received: from localhost (127.0.0.1) by skipper.averillpark.net with POP3 for
<postmaster@skipper.averillpark.net>; 18 Oct 2002 19:00:04 -0000
Return-path: <ChuckMiller@secureprivatepays.net>
Envelope-to: RWELTY@KRUSTY-MOTORSPORTS.COM
Delivery-date: Fri, 18 Oct 2002 18:56:46 +0000
Received: from [216.52.248.42] (helo=jm.secureprivatepay.org)
by krusty1.krusty-motorsports.com with smtp (Exim 4.10)
id 182cIg-0006yN-00
for RWELTY@KRUSTY-MOTORSPORTS.COM; Fri, 18 Oct 2002 18:56:46 +0000
From: Chuck Miller <ChuckMiller@secureprivatepays.net>
To: PHILIP FRONTINO <rwelty@krusty-motorsports.com>
Subject: Stephen King's latest thriller. No Cost Shipping & handling
Date: 18 Oct 2002 12:00:46 -0700
List-Decline: <mailto:tdecline@webtransactionservices.com?Subject=10454299%20decline>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 7bit
Message-Id: <E182cIg-0006yN-00@krusty1.krusty-motorsports.com>