This rule detects potential compromise indicators by identifying traffic to known malicious URLs associated with the 176-65-139-139 malware family, which often serves as a command-and-control channel or payload delivery mechanism. Proactively hunting for these connections allows the SOC team to identify early-stage infections or lateral movement attempts before the adversary establishes full persistence or exfiltrates data within the Azure environment.
Threat: 176-65-139-139 Total URLs: 44 Active URLs: 42
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://176.65.139.139/reflect/x86 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/mips | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/m68k | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/riscv64 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/ppc64 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/x86_64 | offline | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/ppc | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/mips64 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/mipsel | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/s390x | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.ppc | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.arm7 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.arm6 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.i686 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.x86 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.arm | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.arm5 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.sh4 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.mpsl | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/arm8 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/riscv32 | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.spc | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/reflect/dl.sh | offline | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.mips | online | malware_download | 2026-09-02 |
hxxp://176.65.139.139/hiddenbin/reflect.arc | online | malware_download | 2026-09-02 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-139
let malicious_domains = dynamic(["176.65.139.139"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.139"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Legacy Application Whitelisting: Older internal line-of-business applications (e.g., a custom Java-based inventory system) may still reference hardcoded IP addresses for backend services or third-party APIs that have since been assigned to the 176.65.139.139 range due to IP reassignment or shared hosting.
legacy_inv.exe) and the destination port is standard HTTP/HTTPS (80/443), specifically if the user agent string matches the legacy app’s identifier.Scheduled Maintenance Scripts: A nightly PowerShell or Bash script used for log rotation or backup verification might ping or query a status endpoint on 176.65.139.139 to confirm service health before proceeding. This is a legitimate administrative task, not malicious beaconing.
Task Scheduler or cron) where the initiating process is powershell.exe or bash and the command line contains specific keywords like healthcheck, verify, or status.Development Environment Testing: Developers in the QA team may use local proxy tools (like Fiddler, Charles Proxy, or mitmproxy) to intercept traffic. If they are testing a new feature that communicates with a staging server hosted at 176.65.139.139, the proxy might log or forward the request, triggering the URLhaus rule.
Dev or QA in the asset inventory, and the process is a known proxy tool (e.g., fiddler.exe, charles.exe).**Cloud Load