← Back to SOC feed Coverage →

URLhaus: 176-65-139-139 Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-09-02T23:00:00Z · Confidence: medium

Hunt Hypothesis

This rule detects potential compromise indicators by identifying traffic to known malicious URLs associated with the 176-65-139-139 malware family, which often serves as a command-and-control channel or payload delivery mechanism. Proactively hunting for these connections allows the SOC team to identify early-stage infections or lateral movement attempts before the adversary establishes full persistence or exfiltrates data within the Azure environment.

IOC Summary

Threat: 176-65-139-139 Total URLs: 44 Active URLs: 42

URLStatusThreatDate Added
hxxp://176.65.139.139/reflect/x86onlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/mipsonlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/m68konlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/riscv64onlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/ppc64onlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/x86_64offlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/ppconlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/mips64onlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/mipselonlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/s390xonlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.ppconlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.arm7onlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.arm6onlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.i686onlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.x86onlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.armonlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.arm5onlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.sh4onlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.mpslonlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/arm8onlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/riscv32onlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.spconlinemalware_download2026-09-02
hxxp://176.65.139.139/reflect/dl.shofflinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.mipsonlinemalware_download2026-09-02
hxxp://176.65.139.139/hiddenbin/reflect.arconlinemalware_download2026-09-02

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-139
let malicious_domains = dynamic(["176.65.139.139"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.139"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/