URLhaus: 65-108-62-224 Malicious URLs

Hunt Hypothesis

This hunt targets potential adversary activity involving the use of known malicious URLs associated with the IP address 65-108-62-224, which may indicate web-based initial access or command-and-control channels. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or user sessions before the adversary can establish persistence or exfiltrate data.

IOC Summary

Threat: 65-108-62-224 Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 65-108-62-224
let malicious_domains = dynamic(["65.108.62.224"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["65.108.62.224"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy Java-based enterprise resource planning (ERP) system or internal monitoring tool (e.g., Nagios, Zabbix, or custom PowerShell scripts) performs periodic HTTP GET requests to the IP 65.108.62.224 as part of a hardcoded service discovery or heartbeat mechanism that was not updated after the IP was re-registered or flagged.

  • Filter/Exclusion: Exclude the specific source process (e.g., java.exe or powershell.exe) if the destination port is 80/443 and the User-Agent string matches the legacy application’s identifier, or whitelist the specific URL path if it is a known health endpoint.

• Third-Party SaaS Integration Webhooks: A customer relationship management (CRM) platform (e.g., Salesforce, HubSpot, or Zendesk) or a marketing automation tool (e.g., Marketo) sends outbound webhooks or API callbacks to 65.108.62.224 for data synchronization, lead scoring, or event logging. This is a legitimate business function where the IP serves as a backend service endpoint for the vendor.

  • Filter/Exclusion: Exclude the integration service account or the specific application pool identity (e.g., app-pool-salesforce or svc-integration) when the request method is POST/PUT and the content-type is application/json, indicating a structured API call rather than a simple page load.

• Scheduled Backup or Sync Jobs: A scheduled task (e.g., Windows Task Scheduler job named Daily-Backup-Sync or a cron job on Linux servers) initiates an rsync, FTP, or HTTP-based backup transfer to a remote storage node or staging server hosted at 65.108.62.224. This is a routine data movement task