This detection identifies adversary activity involving traffic to a specific set of 19 malicious URLs associated with the URLhaus threat signature 91-208-197-218, which often indicates active command-and-control or phishing infrastructure. The SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the adversary can establish a persistent foothold in the network.
Threat: 91-208-197-218 Total URLs: 19 Active URLs: 19
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://91.208.197.218/kaf.ppc | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/kaf.x86 | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/kaf.mpsl | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/kaf.arm5 | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-crypto | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/kaf.arm7 | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-netns | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-irq | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-netns-rt | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-events | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-mm | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-blkcg | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-cgroup | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-rcu | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-irq-bal | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-softirq | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-writeback | online | malware_download | 2026-08-29 |
hxxp://91.208.197.218/bins/kworkerd-scsi | online | malware_download | 2026-08-29 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 91-208-197-218
let malicious_domains = dynamic(["91.208.197.218"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.208.197.218"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: 91-208-197-218 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:
Automated Security Scanner Traffic: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to verify certificate validity or service availability. These tools often generate HTTP/HTTPS requests that match the signature of the malicious URL pattern, triggering alerts when they scan public-facing assets associated with the 91-208-197-218 IP range.
Source_IP IN [10.50.1.5, 10.50.1.6]) or exclude traffic from specific service accounts used by these tools (e.g., User_Account = 'svc_nessus_scanner').Third-Party Cloud Backup & Sync Agents: Enterprise data protection suites like Veeam, Rubrik, or Microsoft OneDrive for Business often maintain persistent connections to cloud storage gateways. If the backup gateway utilizes a URL structure similar to the detected malicious pattern (e.g., specific API endpoints for manifest retrieval), legitimate synchronization jobs will trigger false alerts during peak backup windows.
Source_Subnet = 192.168.50.0/24) and restrict the rule to only trigger outside of defined maintenance windows (e.g., NOT (Hour >= 2 AND Hour <= 6)).Patch Management Distribution Servers: Systems such