Got it Jaeson.

For those registered domain,

It seems to me like they are using short window periods to update their A records and then reverting back to a 127.0.0.1 for their nefarious delivery system. Basically making it impossible to find these hosts unless one where sensing DNS infrastructure used by the victim/target.

Good work and thanks for the explanation!
Vijay