[lantry]

> Side note: Why use a raw IP address? If anything, this screams “malware.” At least register a decoy domain like lint-checker.com or jenkins-ci-runner.net. If the threat actors who wrote this are reading: take notes people!

Maybe they don't want to give any identifying info to the domain registrar? Or just minimizing their online presence?

[HPsquared]

That's probably the reason bare IP addresses are associated with sketchy stuff.

[cromka]

Or possibly these hosts fell victims of their malware, too, and see now used as proxies.

[valleyer]

That doesn't mean you can't set up DNS names to point at them.

[CITIZENDOT]

fair point