are the domains being used as the from, or as the hosts actually sending the mail? Or just as a place to park the link that the spam points to?