*.ath.cx domains often used to be torrent sites, which is not bad :music:, just they are using it for hiding the real location of their real servers through these dynamic DNS services… Not a good reputation sign for an affiliate group, or a very weak attempt from some dumb scammers. 
Thanks for the heads up Dom!