A domain name can be a reputation.
It can also be a paper cup.
Legitimate organizations usually have reasons to keep the same domain working: customers know it, links point to it, authentication accumulates around it, employees use it, and losing it would be expensive.
An abusive sender can have the opposite incentive.
Once a domain develops a poor reputation, the cheap option may be to abandon it and register another one.
Spamhaus describes this behavior in its documentation on domain blocklisting and snowshoe activity. It notes that abusive operations may use many domains and IP addresses that change frequently, while legitimate bulk senders generally invest in durable identities and long-term reputation. See the Spamhaus Domain Blocklist FAQ.
The point is not that a new domain is suspicious by definition.
The point is that replaceability changes the cost of enforcement.
Reputation only works when somebody cares about keeping it
Sender reputation is useful because bad behavior is supposed to create future consequences.
If a domain sends unwanted mail and recipients complain, filters can learn. If the same identity keeps sending, those consequences accumulate.
But if the operator expects to discard the domain after a short campaign, reputation becomes less of a deterrent.
The sender is not repairing the building.
They are moving to another motel room.
Cheap registration, automated DNS configuration, disposable landing pages, and large domain inventories can make that strategy practical at scale.
The address changes; the operation may not
Investigators therefore look beyond the visible domain.
Repeated templates, tracking parameters, affiliate identifiers, hosting patterns, name servers, registration timing, payment destinations, linked infrastructure, message wording, and campaign schedules can reveal relationships among apparently separate senders.
None of those clues alone proves common ownership. Shared infrastructure and templates can have innocent explanations.
But continuity can exist even when the domain name does not.
This is another industrial feature of Spam Empires: the identity in the From line or hyperlink may be designed to die young.
The operation survives because replacing the label costs less than rehabilitating it.