Here's a slightly revised CIDR list that seems to cover all the IPs used by the spammers so far:
https://gist.github.com/patf/1ae99fdd15718483fc15b1e8c8f25fe2
(some CIDRs are redundant because they're from different sources)
Hopefully that'll do for now.