[SC-Help] They're varying their shields, captain!

[Lane]

I've been getting two or three emails every day for about a month from 
nrefi.net and frefi.net and some other *refi.net's using ip range 85.138.36.x 
but I notice that when I report these to Spam Cop  they don't get blocked.

I understand that the scoring system may prevent a spammer from ever getting 
listed, but I'm curious about the SenderBase information on this ip range.

It appears here: 
http://www.senderbase.org/?searchBy=ipaddress&sb=1&searchString=85.138.36.161

That this IP has had a 100% drop in email in the last 24 hours, yet it has had 
a 502% increase in the last 30 days.  The average magnitude is 1.2%.

So I'm wondering if these guys are just cycling through a set of ip's just 
fast enough to render the senderbase information obsolete just in time to 
avoid being blocked.

Maybe I'm not getting the technology, but it seems to me that these *refi.net 
people are slipping through spamcop like a knife through butter.

lane