Spammers are abusing Kagoya.net and Microsoft exchange via invalid headers

We're getting a ton of to-do spam from kagoya.net and the spammer/phisher is using 127.0.0.1 in the header to bypass O365 email protections to make it look like an internal email.

Yesterday, we got the same to-do but the scammer used O365 to send the messages abusing the headers with 127.0.0.1

Is anyone else seeing such an aggressive campaign and/or how do we get Kagoya blacklisted?

Thanks!