← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-09-02T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets the execution of 32-bit malicious binaries or payloads delivered via known URLhaus URLs, indicating a potential compromise through legacy or x86-specific software. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and contain active threats that may exploit 32-bit process execution paths before they establish persistence or lateral movement within the environment.

IOC Summary

Threat: 32-bit Total URLs: 18 Active URLs: 15

URLStatusThreatDate Added
hxxp://220.201.25.49:47541/bin.shonlinemalware_download2026-09-02
hxxp://95.9.35.137:43208/ionlinemalware_download2026-09-02
hxxp://163.142.93.157:39139/ionlinemalware_download2026-09-02
hxxp://95.9.35.137:43208/bin.shonlinemalware_download2026-09-02
hxxp://60.19.4.185:54029/ionlinemalware_download2026-09-02
hxxp://219.157.63.238:58386/ionlinemalware_download2026-09-02
hxxp://60.19.4.185:54029/bin.shofflinemalware_download2026-09-02
hxxp://219.157.63.238:58386/bin.shonlinemalware_download2026-09-02
hxxp://123.10.225.139:46476/bin.shonlinemalware_download2026-09-02
hxxp://196.189.9.27:53134/bin.shonlinemalware_download2026-09-02
hxxp://59.96.141.7:58981/iofflinemalware_download2026-09-02
hxxp://125.43.45.149:33353/ionlinemalware_download2026-09-02
hxxp://202.1.26.13:41939/ionlinemalware_download2026-09-02
hxxp://42.233.107.113:43544/ionlinemalware_download2026-09-02
hxxp://182.121.239.171:36990/ionlinemalware_download2026-09-02
hxxp://115.57.254.136:42278/bin.shonlinemalware_download2026-09-02
hxxp://105.225.107.183:39153/iofflinemalware_download2026-09-02
hxxp://175.175.22.43:45156/bin.shonlinemalware_download2026-09-02

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["95.9.35.137", "220.201.25.49", "182.121.239.171", "115.57.254.136", "219.157.63.238", "123.10.225.139", "196.189.9.27", "125.43.45.149", "60.19.4.185", "175.175.22.43", "163.142.93.157", "202.1.26.13", "42.233.107.113"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["95.9.35.137", "220.201.25.49", "182.121.239.171", "115.57.254.136", "219.157.63.238", "123.10.225.139", "196.189.9.27", "125.43.45.149", "60.19.4.185", "175.175.22.43", "163.142.93.157", "202.1.26.13", "42.233.107.113"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/