One of such ransomeware launching sites is -dongwooclean.com
See: https://cymon.io/61.14.209.163 (seen just 2 minutes ago).
Also listed here: https://www.malwareurl.com/ & https://www.threatminer.org/domain.php?q=dongwooclean.com
See report on Moar Locky malcode → http://blog.dynamoo.com/2016/11/moar-locky-2016-11-03.html
But the IP here → https://cymon.io/61.14.209.163 that report does not have yet.
Good to have avast to save our devices from such threats.
polonus