← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-27T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving the execution of 32-bit malware through known malicious URLs sourced from the URLhaus threat intelligence feed. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement driven by legacy architecture vulnerabilities.

IOC Summary

Threat: 32-bit Total URLs: 52 Active URLs: 45

URLStatusThreatDate Added
hxxp://115.55.47.135:39299/bin.shonlinemalware_download2026-08-27
hxxp://125.46.131.9:49040/bin.shonlinemalware_download2026-08-27
hxxp://27.215.54.219:55163/ionlinemalware_download2026-08-27
hxxp://182.121.177.176:36990/ionlinemalware_download2026-08-27
hxxp://124.131.128.79:49267/ionlinemalware_download2026-08-27
hxxp://42.228.46.234:49037/ionlinemalware_download2026-08-27
hxxp://27.215.54.219:55163/bin.shonlinemalware_download2026-08-27
hxxp://42.56.35.155:55769/ionlinemalware_download2026-08-27
hxxp://42.56.35.155:55769/bin.shonlinemalware_download2026-08-27
hxxp://42.228.46.234:49037/bin.shonlinemalware_download2026-08-27
hxxp://179.108.89.220:60440/bin.shonlinemalware_download2026-08-27
hxxp://124.131.128.79:49267/bin.shonlinemalware_download2026-08-27
hxxp://123.12.232.76:41158/bin.shonlinemalware_download2026-08-27
hxxp://222.142.253.198:55164/bin.shonlinemalware_download2026-08-27
hxxp://119.179.252.91:42980/ionlinemalware_download2026-08-27
hxxp://196.190.11.194:48645/ionlinemalware_download2026-08-27
hxxp://119.179.252.91:42980/bin.shonlinemalware_download2026-08-27
hxxp://42.235.44.102:53181/ionlinemalware_download2026-08-27
hxxp://42.235.44.102:53181/bin.shonlinemalware_download2026-08-27
hxxp://115.50.70.160:43741/ionlinemalware_download2026-08-27
hxxp://222.137.39.209:33458/ionlinemalware_download2026-08-27
hxxp://222.137.39.209:33458/bin.shonlinemalware_download2026-08-27
hxxp://115.50.70.160:43741/bin.shonlinemalware_download2026-08-27
hxxp://115.50.149.84:44853/ionlinemalware_download2026-08-27
hxxp://125.41.3.138:43039/ionlinemalware_download2026-08-27

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["125.47.247.14", "42.56.35.155", "125.41.3.138", "27.215.54.219", "115.50.70.160", "179.108.89.220", "125.46.131.9", "222.142.253.198", "222.137.39.209", "123.12.232.76", "42.235.90.191", "196.190.11.194", "115.50.149.84", "119.179.252.91", "42.235.44.102", "42.228.46.234", "124.131.128.79", "115.55.47.135", "182.121.177.176"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["125.47.247.14", "42.56.35.155", "125.41.3.138", "27.215.54.219", "115.50.70.160", "179.108.89.220", "125.46.131.9", "222.142.253.198", "222.137.39.209", "123.12.232.76", "42.235.90.191", "196.190.11.194", "115.50.149.84", "119.179.252.91", "42.235.44.102", "42.228.46.234", "124.131.128.79", "115.55.47.135", "182.121.177.176"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://urlhaus.abuse.ch/