← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-06-29T11:00:01Z · Confidence: medium

Hunt Hypothesis

This hunt targets adversary behavior where compromised systems attempt to communicate with known 32-bit malicious domains identified by URLhaus, indicating potential malware execution or command-and-control activity. Proactively hunting for these specific URLs in Azure Sentinel is critical because it enables the SOC team to identify and isolate early-stage infections before they escalate into broader lateral movement incidents within the network.

IOC Summary

Threat: 32-bit Total URLs: 25 Active URLs: 25

URLStatusThreatDate Added
hxxp://115.55.168.68:57536/bin.shonlinemalware_download2026-06-29
hxxp://123.12.21.35:42838/ionlinemalware_download2026-06-29
hxxp://27.44.144.168:43603/bin.shonlinemalware_download2026-06-29
hxxp://123.12.21.35:42838/bin.shonlinemalware_download2026-06-29
hxxp://113.237.48.192:40812/ionlinemalware_download2026-06-29
hxxp://182.114.252.213:57272/bin.shonlinemalware_download2026-06-29
hxxp://182.121.11.158:41632/ionlinemalware_download2026-06-29
hxxp://125.160.139.235:52365/ionlinemalware_download2026-06-29
hxxp://220.167.189.103:48336/ionlinemalware_download2026-06-29
hxxp://220.167.189.103:48336/bin.shonlinemalware_download2026-06-29
hxxp://182.121.11.158:41632/bin.shonlinemalware_download2026-06-29
hxxp://113.237.48.192:40812/bin.shonlinemalware_download2026-06-29
hxxp://61.52.46.195:48072/ionlinemalware_download2026-06-29
hxxp://61.53.75.82:41799/bin.shonlinemalware_download2026-06-29
hxxp://182.113.1.195:57495/bin.shonlinemalware_download2026-06-29
hxxp://61.52.46.195:48072/bin.shonlinemalware_download2026-06-29
hxxp://115.57.237.132:38874/ionlinemalware_download2026-06-29
hxxp://115.57.237.132:38874/bin.shonlinemalware_download2026-06-29
hxxp://110.39.255.227:51699/bin.shonlinemalware_download2026-06-29
hxxp://222.137.80.156:43412/bin.shonlinemalware_download2026-06-29
hxxp://125.41.140.82:40678/bin.shonlinemalware_download2026-06-29
hxxp://39.79.12.78:40041/ionlinemalware_download2026-06-29
hxxp://39.79.12.78:40041/bin.shonlinemalware_download2026-06-29
hxxp://123.234.188.68:41568/ionlinemalware_download2026-06-29
hxxp://219.155.239.28:33452/ionlinemalware_download2026-06-29

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["115.55.168.68", "219.155.239.28", "113.237.48.192", "123.12.21.35", "27.44.144.168", "125.160.139.235", "182.113.1.195", "115.57.237.132", "61.53.75.82", "222.137.80.156", "39.79.12.78", "182.121.11.158", "182.114.252.213", "123.234.188.68", "110.39.255.227", "220.167.189.103", "61.52.46.195", "125.41.140.82"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.55.168.68", "219.155.239.28", "113.237.48.192", "123.12.21.35", "27.44.144.168", "125.160.139.235", "182.113.1.195", "115.57.237.132", "61.53.75.82", "222.137.80.156", "39.79.12.78", "182.121.11.158", "182.114.252.213", "123.234.188.68", "110.39.255.227", "220.167.189.103", "61.52.46.195", "125.41.140.82"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

Original source: https://urlhaus.abuse.ch/