← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-30T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary behavior involving the execution of 32-bit malware payloads delivered through known malicious URLs flagged by URLhaus. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before these legacy threats exploit vulnerabilities in mixed-architecture environments.

IOC Summary

Threat: 32-bit Total URLs: 40 Active URLs: 29

URLStatusThreatDate Added
hxxp://124.6.169.46:33212/bin.shonlinemalware_download2026-08-30
hxxp://175.149.67.160:36060/ionlinemalware_download2026-08-30
hxxp://219.154.174.39:60220/ionlinemalware_download2026-08-30
hxxp://182.113.27.187:49881/ionlinemalware_download2026-08-30
hxxp://120.84.213.26:48371/ionlinemalware_download2026-08-30
hxxp://59.97.249.68:48169/ionlinemalware_download2026-08-30
hxxp://182.121.181.105:36990/ionlinemalware_download2026-08-30
hxxp://219.154.174.39:60220/bin.shonlinemalware_download2026-08-30
hxxp://39.74.2.161:45451/ionlinemalware_download2026-08-30
hxxp://59.97.249.68:48169/bin.shofflinemalware_download2026-08-30
hxxp://39.74.2.161:45451/bin.shonlinemalware_download2026-08-30
hxxp://27.215.215.75:51224/ionlinemalware_download2026-08-30
hxxp://163.142.92.157:40373/ionlinemalware_download2026-08-30
hxxp://163.142.92.157:40373/bin.shonlinemalware_download2026-08-30
hxxp://182.117.69.14:39814/ionlinemalware_download2026-08-30
hxxp://182.121.41.234:52522/ionlinemalware_download2026-08-30
hxxp://219.157.190.80:41921/ionlinemalware_download2026-08-30
hxxp://182.121.106.206:50819/iofflinemalware_download2026-08-30
hxxp://182.121.106.206:50819/bin.shofflinemalware_download2026-08-30
hxxp://222.219.25.40:41597/bin.shonlinemalware_download2026-08-30
hxxp://115.58.181.180:33235/ionlinemalware_download2026-08-30
hxxp://196.190.133.180:53984/ionlinemalware_download2026-08-30
hxxp://175.165.141.12:57080/iofflinemalware_download2026-08-30
hxxp://175.165.141.12:57080/bin.shonlinemalware_download2026-08-30
hxxp://182.120.132.147:50830/bin.shonlinemalware_download2026-08-30

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["120.84.213.26", "112.198.130.112", "182.121.181.105", "219.154.174.39", "163.142.92.157", "59.97.249.68", "196.190.133.180", "113.221.76.194", "182.113.27.187", "112.198.193.62", "182.121.41.234", "222.219.25.40", "219.157.190.80", "115.58.181.180", "182.120.132.147", "175.165.141.12", "115.49.77.192", "39.74.2.161", "124.6.169.46", "113.228.97.87", "115.49.73.224", "182.117.69.14", "175.149.67.160", "27.215.215.75"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["120.84.213.26", "112.198.130.112", "182.121.181.105", "219.154.174.39", "163.142.92.157", "59.97.249.68", "196.190.133.180", "113.221.76.194", "182.113.27.187", "112.198.193.62", "182.121.41.234", "222.219.25.40", "219.157.190.80", "115.58.181.180", "182.120.132.147", "175.165.141.12", "115.49.77.192", "39.74.2.161", "124.6.169.46", "113.228.97.87", "115.49.73.224", "182.117.69.14", "175.149.67.160", "27.215.215.75"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://urlhaus.abuse.ch/