Q. What do you get if you cross 18.104.22.168 with a bunch of newly created domains?
A. Over 600 newly malicious URLs of course!
There's actually only a very small amount of domains, but 91 URLs to each domain, serving a grand total across them all, of 498 files and 71 unique MD5s;
You'll find the domains and URLs listed in hpHosts and MDL of course, Malwarebytes AntiMalware users will be pleased to know, 477 of the files are already detected, and those that aren't, shortly will be.
The URLs on their own for those wanting them;
Seems they're using a secondary Leaseweb IP as of a few mins ago (22.214.171.124)