← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-15T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving access to known 32-bit malicious URLs, which often indicates initial reconnaissance or command-and-control communication from legacy systems. Proactively hunting for these indicators in Azure Sentinel is critical because 32-bit processes are frequently targeted by attackers exploiting older architectures that may lack modern security controls.

IOC Summary

Threat: 32-bit Total URLs: 57 Active URLs: 37

URLStatusThreatDate Added
hxxp://182.124.119.64:56849/ionlinemalware_download2026-08-15
hxxp://221.14.40.110:37931/ionlinemalware_download2026-08-15
hxxp://196.189.68.239:58818/ionlinemalware_download2026-08-15
hxxp://110.37.61.166:60696/ionlinemalware_download2026-08-15
hxxp://123.10.155.173:55027/ionlinemalware_download2026-08-15
hxxp://182.124.119.64:56849/bin.shonlinemalware_download2026-08-15
hxxp://110.37.61.166:60696/bin.shonlinemalware_download2026-08-15
hxxp://156.146.24.110:48908/ionlinemalware_download2026-08-15
hxxp://196.189.68.239:58818/bin.shonlinemalware_download2026-08-15
hxxp://123.10.155.173:55027/bin.shonlinemalware_download2026-08-15
hxxp://182.116.118.104:55662/bin.shonlinemalware_download2026-08-15
hxxp://156.146.24.110:48908/bin.shonlinemalware_download2026-08-15
hxxp://175.174.66.196:56771/ionlinemalware_download2026-08-15
hxxp://46.159.139.237:45921/bin.shonlinemalware_download2026-08-15
hxxp://182.121.82.149:47697/ionlinemalware_download2026-08-15
hxxp://115.51.38.188:51859/bin.shonlinemalware_download2026-08-15
hxxp://182.121.82.149:47697/bin.shofflinemalware_download2026-08-15
hxxp://1.58.182.84:51623/iofflinemalware_download2026-08-15
hxxp://125.110.49.243:54807/iofflinemalware_download2026-08-15
hxxp://115.50.101.188:34800/iofflinemalware_download2026-08-15
hxxp://125.110.49.243:54807/bin.shonlinemalware_download2026-08-15
hxxp://115.50.101.188:34800/bin.shonlinemalware_download2026-08-15
hxxp://125.45.64.24:42706/iofflinemalware_download2026-08-15
hxxp://125.45.64.24:42706/bin.shonlinemalware_download2026-08-15
hxxp://200.115.102.2:47663/bin.shonlinemalware_download2026-08-15

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["182.116.118.104", "110.36.1.200", "59.96.138.90", "46.159.139.237", "182.124.119.64", "182.117.131.145", "222.142.222.21", "182.121.82.149", "110.37.61.166", "200.115.102.2", "110.36.72.182", "219.157.243.71", "115.51.38.188", "115.50.101.188", "175.174.66.196", "156.146.24.110", "125.45.64.24", "123.10.155.173", "221.14.40.110", "125.110.49.243", "42.239.179.192", "115.55.10.187", "196.189.68.239", "42.231.186.227"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.116.118.104", "110.36.1.200", "59.96.138.90", "46.159.139.237", "182.124.119.64", "182.117.131.145", "222.142.222.21", "182.121.82.149", "110.37.61.166", "200.115.102.2", "110.36.72.182", "219.157.243.71", "115.51.38.188", "115.50.101.188", "175.174.66.196", "156.146.24.110", "125.45.64.24", "123.10.155.173", "221.14.40.110", "125.110.49.243", "42.239.179.192", "115.55.10.187", "196.189.68.239", "42.231.186.227"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Original source: https://urlhaus.abuse.ch/