← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-07-17T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets adversaries leveraging known 32-bit malicious URLs to deliver payloads or establish command-and-control channels within Azure Sentinel environments. Proactively hunting these specific indicators is critical because their high severity and prevalence suggest a widespread threat vector that could compromise legacy systems before automated detection triggers an alert.

IOC Summary

Threat: 32-bit Total URLs: 30 Active URLs: 29

URLStatusThreatDate Added
hxxp://175.175.135.32:53741/ionlinemalware_download2026-07-17
hxxp://60.25.1.67:47355/bin.shonlinemalware_download2026-07-17
hxxp://219.156.33.32:33066/ionlinemalware_download2026-07-17
hxxp://175.175.135.32:53741/bin.shonlinemalware_download2026-07-17
hxxp://219.156.33.32:33066/bin.shonlinemalware_download2026-07-17
hxxp://42.238.240.6:47417/ionlinemalware_download2026-07-17
hxxp://27.159.173.106:51830/ionlinemalware_download2026-07-17
hxxp://222.141.10.41:52985/bin.shonlinemalware_download2026-07-17
hxxp://42.238.240.6:47417/bin.shonlinemalware_download2026-07-17
hxxp://125.47.240.62:41604/ionlinemalware_download2026-07-17
hxxp://221.14.17.203:39346/ionlinemalware_download2026-07-17
hxxp://27.159.173.106:51830/bin.shonlinemalware_download2026-07-17
hxxp://221.14.17.203:39346/bin.shonlinemalware_download2026-07-17
hxxp://221.1.225.152:39037/ionlinemalware_download2026-07-17
hxxp://221.1.225.152:39037/bin.shonlinemalware_download2026-07-17
hxxp://182.116.117.45:36277/ionlinemalware_download2026-07-17
hxxp://182.113.45.71:41749/ionlinemalware_download2026-07-17
hxxp://105.186.143.197:56177/ionlinemalware_download2026-07-17
hxxp://182.116.117.45:36277/bin.shonlinemalware_download2026-07-17
hxxp://115.55.197.181:45657/ionlinemalware_download2026-07-17
hxxp://219.157.234.137:51727/ionlinemalware_download2026-07-17
hxxp://182.113.45.71:41749/bin.shonlinemalware_download2026-07-17
hxxp://115.55.197.181:45657/bin.shonlinemalware_download2026-07-17
hxxp://182.121.157.48:59212/ionlinemalware_download2026-07-17
hxxp://182.124.23.15:33387/ionlinemalware_download2026-07-17

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["222.141.10.41", "219.156.33.32", "42.224.93.190", "182.116.117.45", "221.1.225.152", "39.87.0.220", "110.37.5.60", "182.113.45.71", "115.55.197.181", "42.238.240.6", "125.47.240.62", "105.186.143.197", "221.14.17.203", "175.175.135.32", "27.159.173.106", "182.124.23.15", "219.157.234.137", "60.25.1.67", "182.121.157.48"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.141.10.41", "219.156.33.32", "42.224.93.190", "182.116.117.45", "221.1.225.152", "39.87.0.220", "110.37.5.60", "182.113.45.71", "115.55.197.181", "42.238.240.6", "125.47.240.62", "105.186.143.197", "221.14.17.203", "175.175.135.32", "27.159.173.106", "182.124.23.15", "219.157.234.137", "60.25.1.67", "182.121.157.48"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs rule in an enterprise environment, including suggested filters or exclusions:

Original source: https://urlhaus.abuse.ch/