← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-14T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of 32-bit malware via known malicious URLs identified by URLhaus, which often serve as initial infection vectors or command-and-control channels for legacy-targeted attacks. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage compromises on 32-bit systems and prevent lateral movement before the adversary establishes a persistent foothold.

IOC Summary

Threat: 32-bit Total URLs: 50 Active URLs: 39

URLStatusThreatDate Added
hxxp://182.127.177.126:47422/ionlinemalware_download2026-08-14
hxxp://110.36.70.28:58014/ionlinemalware_download2026-08-14
hxxp://182.127.177.126:47422/bin.shonlinemalware_download2026-08-14
hxxp://42.230.18.71:37623/bin.shonlinemalware_download2026-08-14
hxxp://42.230.18.71:37623/ionlinemalware_download2026-08-14
hxxp://1.58.182.84:51623/bin.shonlinemalware_download2026-08-14
hxxp://220.192.252.142:56157/ionlinemalware_download2026-08-14
hxxp://179.108.89.220:55094/bin.shonlinemalware_download2026-08-14
hxxp://222.142.250.250:43654/ionlinemalware_download2026-08-14
hxxp://222.142.250.250:43654/bin.shonlinemalware_download2026-08-14
hxxp://119.183.3.192:41382/bin.shofflinemalware_download2026-08-14
hxxp://96.245.232.233:44492/iofflinemalware_download2026-08-14
hxxp://115.55.233.2:37781/ionlinemalware_download2026-08-14
hxxp://122.235.157.125:52016/ionlinemalware_download2026-08-14
hxxp://115.55.233.2:37781/bin.shonlinemalware_download2026-08-14
hxxp://42.178.168.78:33507/iofflinemalware_download2026-08-14
hxxp://42.178.168.78:33507/bin.shonlinemalware_download2026-08-14
hxxp://222.141.82.215:49425/ionlinemalware_download2026-08-14
hxxp://118.232.137.101:42009/ionlinemalware_download2026-08-14
hxxp://222.141.82.215:49425/bin.shonlinemalware_download2026-08-14
hxxp://110.38.221.182:35958/ionlinemalware_download2026-08-14
hxxp://118.232.137.101:42009/bin.shonlinemalware_download2026-08-14
hxxp://110.38.221.182:35958/bin.shonlinemalware_download2026-08-14
hxxp://115.49.198.105:41583/bin.shonlinemalware_download2026-08-14
hxxp://182.121.46.253:58630/ionlinemalware_download2026-08-14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["118.232.137.101", "182.127.177.126", "27.215.181.39", "101.109.232.82", "182.113.206.161", "122.235.157.125", "179.108.89.220", "115.55.233.2", "222.141.82.215", "42.178.168.78", "110.38.221.182", "1.58.182.84", "42.230.18.71", "220.192.252.142", "115.49.198.105", "110.36.70.28", "182.116.119.9", "182.121.46.253", "222.142.250.250"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["118.232.137.101", "182.127.177.126", "27.215.181.39", "101.109.232.82", "182.113.206.161", "122.235.157.125", "179.108.89.220", "115.55.233.2", "222.141.82.215", "42.178.168.78", "110.38.221.182", "1.58.182.84", "42.230.18.71", "220.192.252.142", "115.49.198.105", "110.36.70.28", "182.116.119.9", "182.121.46.253", "222.142.250.250"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Original source: https://urlhaus.abuse.ch/