URLs and sub domains distributing the malware or acting as a redirector:
Domain onotiw.dnset.com is at: 31.148.220.14 (14.220.148.31.in-addr.arpa)