URLs and sub domains distributing the malware or acting as a redirector:
Domain cep40.ca is at: 76.74.128.10 (hp63.hostpapa.com)