Emotet malware distribution @185.50.25.50 [compromise website]

The host at this IP address is hosting a website that have been compromised by threat actors to distribute Emotet (aka Heodo) malware. The following URL is hosting a webshell that is being accessed by the threat actors programmatically to place malware on the website:

URL: http://technovolunteers.ru/wp-content/themes/twentytwenty/template-parts/JST10x.php
Host: technovolunteers.ru
IP address: 185.50.25.50
Hostname: m2.free3.beget.com