Here's some of my initial thoughts.
In the domain is what I would call the "real" part of the domain.
farmsex.com farmsex.co.uk
The part before the "farmsex" should be ignored. Anyone who controls the domains also probably controls the subdomains and that is likely the rotating part.
Additionally - a reverse lookup should be done on the IPs of the links for the purpouses of statistical tracking. We might find the the resolved IP is always spam - or always not spam - or sometimes spam and sometimes not spam. We may be able to return a score on the resolved IP addresses. I believe that we are going to see a lot of spam linking to the same IP or groups of IPs and that if a new URI resolves to the same IP address as farmsex.com then it is likely also spam.
The thought is that spammers might start linking to cnn.com or something to try to raise the score - even if it's in hidden text. And - that's an issue - but live links to other sites might defeat the purpose of the spam and mixing blacklisted sites with nonblacklisted might even become a stronger indicator of spam.
