URLs and sub domains distributing the malware or acting as a redirector:
Domain beforew.com is at: 31.184.192.212 (31.184.192.212)