Emotet malware distribution @52.172.219.121 [compromise website]

The host at this IP address is hosting a website that have been compromised by threat actors to distribute Emotet (aka Heodo) malware. The following URL is hosting a webshell that is being accessed by the threat actors programmatically to place malware on the website:

URL: http://solicwebaps.azurewebsites.net/dbtayzipqcvrw.php
Host: solicwebaps.azurewebsites.net
IP address: 52.172.219.121
Hostname: n/a