This hunt targets the presence of 46 known malicious URLs associated with the Censys tag, which adversaries frequently leverage for command-and-control channels or initial access vectors. Proactively identifying these indicators in Azure Sentinel allows the SOC to detect compromised endpoints or phishing campaigns before they escalate into broader lateral movement or data exfiltration events.
Threat: censys Total URLs: 46 Active URLs: 29
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://8.219.239.117:60139/linux | online | malware_download | 2026-09-06 |
hxxp://8.219.108.63:60142/linux | online | malware_download | 2026-09-06 |
hxxp://8.219.201.139:60102/linux | online | malware_download | 2026-09-06 |
hxxp://106.225.235.90:60106/linux | online | malware_download | 2026-09-06 |
hxxp://47.237.118.211:60105/linux | online | malware_download | 2026-09-06 |
hxxp://47.236.18.24:60116/linux | online | malware_download | 2026-09-06 |
hxxp://8.222.160.231:60148/linux | online | malware_download | 2026-09-06 |
hxxp://47.236.51.52:60136/linux | online | malware_download | 2026-09-06 |
hxxp://47.245.99.183:60117/linux | online | malware_download | 2026-09-06 |
hxxp://47.84.123.75:60102/linux | online | malware_download | 2026-09-06 |
hxxp://47.76.159.198:60144/linux | online | malware_download | 2026-09-06 |
hxxp://47.245.89.183:60131/linux | online | malware_download | 2026-09-06 |
hxxp://185.104.63.79/mips | online | malware_download | 2026-09-06 |
hxxp://5.175.211.23/bins/xnxnxnxnxnxnxnxnpowerpcxnxn | online | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/mips | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/ppc | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/i686 | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/mipsel | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/arm6 | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/m68k | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/android-arm | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/x86 | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/arc | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/x86_64 | offline | malware_download | 2026-09-06 |
hxxp://77.239.124.123/hiddenbin/arm5 | offline | malware_download | 2026-09-06 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: censys
let malicious_domains = dynamic(["8.219.201.139", "8.219.239.117", "47.76.159.198", "106.225.235.90", "185.104.63.79", "5.181.187.75", "47.236.51.52", "8.222.160.231", "8.219.108.63", "5.175.211.23", "47.245.99.183", "47.236.18.24", "92.112.125.51", "47.84.123.75", "47.237.118.211", "47.245.89.183"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["8.219.201.139", "8.219.239.117", "47.76.159.198", "106.225.235.90", "185.104.63.79", "5.181.187.75", "47.236.51.52", "8.222.160.231", "8.219.108.63", "5.175.211.23", "47.245.99.183", "47.236.18.24", "92.112.125.51", "47.84.123.75", "47.237.118.211", "47.245.89.183"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
10.20.0.0/24) or specific service accounts used by the scanning tool (e.g., svc-nessus, qualys-agent).jenkins-agent, gitlab-runner, azure-devops-agent) or specific user agents containing ci-cd or build-pipeline in the HTTP header.curl, wget) to manually verify DNS records or certificate transparency logs for a new subdomain before production rollout, hitting Censys-hosted resources.
192.168.10.0/24) and the process name is a standard browser (chrome.exe, edge.exe) or CLI tool (curl.exe, wget.exe).