A new "Received" header is added by each mail server that handles the message on its way from sender to recipient, with each new on inserted above the previous one. Therefore the bottom-most Received header shows what IP address the first mail server in the chain received the message from. Normally that IP address is the one on which you want to filter. Unfortunately, "Received" headers can be and often are spoofed in spam e-mail. Also unfortunately, most spam these days is distribute from botnets typically comprised of thousands of hijacked PCs all over the world, so you can receive the exact same message from any one of thousands of IP addresses. Trying to block spam by filtering on the originating IP address is as futile as trying to block it by filtering on the sender's e-mail address, which is always spoofed in spam. It might make you feel like you're doing something about the problem, but making you feel good is all it accomplishes.