← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-09-04T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt identifies potential compromise vectors by correlating network traffic with a curated list of 32-bit malicious URLs known to host executable payloads or landing pages. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage web-based attacks or drive-by downloads before they progress to lateral movement or data exfiltration.

IOC Summary

Threat: 32-bit Total URLs: 45 Active URLs: 33

URLStatusThreatDate Added
hxxp://180.190.186.97:52355/ionlinemalware_download2026-09-04
hxxp://115.48.146.57:50353/ionlinemalware_download2026-09-04
hxxp://115.48.146.57:50353/bin.shonlinemalware_download2026-09-04
hxxp://182.121.216.74:42289/ionlinemalware_download2026-09-04
hxxp://58.65.210.197:57970/ionlinemalware_download2026-09-04
hxxp://182.127.123.120:45115/ionlinemalware_download2026-09-04
hxxp://27.206.202.203:55701/ionlinemalware_download2026-09-04
hxxp://58.65.210.197:57970/bin.shonlinemalware_download2026-09-04
hxxp://182.127.123.120:45115/bin.shonlinemalware_download2026-09-04
hxxp://182.121.216.74:42289/bin.shonlinemalware_download2026-09-04
hxxp://27.206.202.203:55701/bin.shonlinemalware_download2026-09-04
hxxp://218.29.147.41:58663/ionlinemalware_download2026-09-04
hxxp://182.124.41.251:59176/iofflinemalware_download2026-09-04
hxxp://182.124.41.251:59176/bin.shonlinemalware_download2026-09-04
hxxp://42.230.24.16:58927/iofflinemalware_download2026-09-04
hxxp://125.41.229.38:58416/ionlinemalware_download2026-09-04
hxxp://39.86.247.62:38819/bin.shonlinemalware_download2026-09-04
hxxp://125.45.49.209:37734/bin.shonlinemalware_download2026-09-04
hxxp://124.131.133.51:53693/iofflinemalware_download2026-09-04
hxxp://124.131.133.51:53693/bin.shofflinemalware_download2026-09-04
hxxp://125.41.229.38:58416/bin.shonlinemalware_download2026-09-04
hxxp://218.29.147.41:58663/bin.shonlinemalware_download2026-09-04
hxxp://105.184.42.145:36337/ionlinemalware_download2026-09-04
hxxp://105.184.42.145:36337/bin.shonlinemalware_download2026-09-04
hxxp://222.127.158.71:56426/bin.shonlinemalware_download2026-09-04

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["105.184.42.145", "125.45.49.209", "115.55.52.180", "180.190.186.97", "182.127.123.120", "27.206.202.203", "218.29.147.41", "222.127.158.71", "182.121.216.74", "115.192.97.236", "27.215.49.38", "115.48.146.57", "120.28.139.121", "182.124.41.251", "125.41.229.38", "58.65.210.197", "39.86.247.62", "60.23.195.26"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["105.184.42.145", "125.45.49.209", "115.55.52.180", "180.190.186.97", "182.127.123.120", "27.206.202.203", "218.29.147.41", "222.127.158.71", "182.121.216.74", "115.192.97.236", "27.215.49.38", "115.48.146.57", "120.28.139.121", "182.124.41.251", "125.41.229.38", "58.65.210.197", "39.86.247.62", "60.23.195.26"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/