URLhaus: 46-151-182-200 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where endpoints access known malicious web resources associated with the specific threat signature 46-151-182-200 from URLhaus. Proactive hunting for these URLs in Azure Sentinel is critical to rapidly isolate compromised assets and prevent potential data exfiltration or lateral movement before broader infection occurs.

IOC Summary

Threat: 46-151-182-200 Total URLs: 9 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 46-151-182-200
let malicious_domains = dynamic(["46.151.182.200"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["46.151.182.200"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 46-151-182-200 Malicious URLs detection rule:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability management tools (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to validate certificate chains and service availability. These scanners often generate HTTP requests to the specific IP range 46-151-182-200 as part of their standard discovery routine, triggering alerts due to the sheer volume of connection attempts from known scanner subnets.
  • Filter/Exclusion: Create a rule exclusion based on the source host list containing all internal vulnerability scanners (e.g., Host_Name contains "Tenable-Scanner" OR Host_IP in [10.20.5.1, 10.20.5.2]) and restrict the alert to only trigger if the destination URL is not a known scanner target or if the request method is not GET/HEAD.

• Scenario: Scheduled Cloud Backup Synchronization

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik utilize scheduled jobs to sync metadata and verify repository health. During the nightly “Health Check” window, these agents initiate outbound connections to the URLhaus IP 46-151-182-200 to fetch the latest threat intelligence feed updates required for their own policy engines, which mimics a malicious URL access pattern.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., Time between 02:00 and 04:00 UTC) combined with a process filter targeting the specific backup