this spam I came across a questionable OVH reseller using the 18.104.22.168/27 range, allocated to userlogin.me.
descr: Userlogin account solutions
changed: firstname.lastname@example.org 20140521
A look at passive DNS records show a variety of sites including stressers, phishing pages, spammers, some malware, plus some other sites which are probably less evil. A lot of these sites are hiding behind Cloudflare, some other sites have moved on to other hosts.
I checked the current IPs and reputations of all the domains that I can find associate with the domain and put them here [csv]. Don't assume they are all evil, but some of those sites are.. interesting.