I notice a lot of spammers are using throwaway subdomains on the same TLD, so something like:
bad1.spam.cc
bad2.spam.cc
The problem there is we have to update the list every time, instead of just blocking spam.cc in the email checker list we have setup...