I checked the last ones, and they were at nostr.mom and no.st.cr.

I've just disabled them, now testing... I'm afraid the spam is everywhere, though