We have lately been getting kinda slammed with new spam probe accounts. They are coming from a range of dynamic IPs in Asia. When a new suspect shows up, occasionally we have caught the current IP as the same as one previously used (using Last IP). But then next time they are on, they may be on a new IP that’s not been used before. Just depends on the timing of when we happen to check.
The next time they are on, may be a different IP that’s not been seen yet. But if we knew that the IP they were on the previous time (after Reg IP but before Last IP), matched one of the other known bad ones, we’d be more confident blocking.
We’ve considered blocking a range of IPs, but need to be careful not to inadvertently block any legit users.