← Back to SOC feed Coverage →

URLhaus: 91-208-197-218 Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-29T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving traffic to a specific set of 19 malicious URLs associated with the URLhaus threat signature 91-208-197-218, which often indicates active command-and-control or phishing infrastructure. The SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the adversary can establish a persistent foothold in the network.

IOC Summary

Threat: 91-208-197-218 Total URLs: 19 Active URLs: 19

URLStatusThreatDate Added
hxxp://91.208.197.218/kaf.ppconlinemalware_download2026-08-29
hxxp://91.208.197.218/kaf.x86onlinemalware_download2026-08-29
hxxp://91.208.197.218/kaf.mpslonlinemalware_download2026-08-29
hxxp://91.208.197.218/kaf.arm5onlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-cryptoonlinemalware_download2026-08-29
hxxp://91.208.197.218/kaf.arm7onlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-netnsonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-irqonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-netns-rtonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-eventsonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-mmonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerdonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-blkcgonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-cgrouponlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-rcuonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-irq-balonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-softirqonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-writebackonlinemalware_download2026-08-29
hxxp://91.208.197.218/bins/kworkerd-scsionlinemalware_download2026-08-29

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 91-208-197-218
let malicious_domains = dynamic(["91.208.197.218"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.208.197.218"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 91-208-197-218 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

Original source: https://urlhaus.abuse.ch/