VT report] being reached via 18.104.22.168 (AirISP, Russia) [VT report].
Whatever it is, it is using subdomains from hijacked GoDaddy accounts   which is a clear sign of badness. The hijacked GoDaddy domains change very quickly, but these have all been used in the past day or so on both those IPs:
For practical purposes though I recommend you block traffic to the IPs rather than the domains.
These following nearby IPs have also been distributing badness. I recommend you block these too: