This hunt targets potential web-based intrusion attempts by identifying traffic to known malicious URLs associated with the 196-251-121-178 tag, which often serve as initial access vectors or command-and-control channels. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect compromised endpoints or phishing campaigns before they escalate into lateral movement or data exfiltration events.
Threat: 196-251-121-178 Total URLs: 2 Active URLs: 0
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://196.251.121.178/bin/support.client.exe | offline | malware_download | 2026-09-27 |
hxxp://196.251.121.178/Bin/ScreenConnect.ClientSetup.exe | offline | malware_download | 2026-09-27 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 196-251-121-178
let malicious_domains = dynamic(["196.251.121.178"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["196.251.121.178"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Legacy Application Health Checks: A deprecated internal web portal (e.g., built on an older PHP stack) uses a hardcoded health check endpoint that points to the IP 196.251.121.178 for load balancing verification or failover testing. This is often triggered by a scheduled cron job or a Windows Task Scheduler entry running every 5 minutes.
app-legacy-01) and the destination port is 80 or 443, specifically if the User-Agent string matches the legacy application’s identifier (e.g., LegacyHealthCheck/1.0).Third-Party SaaS Webhooks: A CI/CD pipeline (e.g., Jenkins or GitLab CI) sends build status notifications or artifact metadata to a third-party monitoring service that hosts its API gateway on 196.251.121.178. This occurs during every successful build or deployment, creating high-frequency HTTP POST requests.
jenkins-master) and the request path contains /webhook or /notify, provided the response status code is 200 or 202.CDN or Edge Caching Nodes: An enterprise CDN provider (e.g., Akamai or Fastly) uses 196.251.121.178 as an edge node for caching static assets (CSS/JS) for a public-facing marketing site. Internal employees or automated scanners accessing the site may trigger this if the DNS resolution points to this specific IP for certain geographic regions.