List of domains/hosts220.127.116.11/irs/
Perhaps a small botnet is involved. Apparently, the DNS for the scams is currently provided by
a.dnspod.com [IP 18.104.22.168]
b.dnspod.com [IP 22.214.171.124]
The sites are newly registered through TODAYNIC.COM, INC., using "Whois Privacy Protection Service" to conceal their criminal activities.