The host at this IP address (40.116.232.96) is either operated by cybercriminals or hosting compromised websites that are being used to distribute malware:
http://zipshare.blob.core.windows.net/312eb1f7-d9f0-40e0-9f20-1c8ee176f1cc/TT%20payment.zip
AS number: AS8075
AS name: MICROSOFT-CORP-MSN-AS-BLOCK — Microsoft Corporation