← Back to SOC feed Coverage →

URLhaus: censys Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-23T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary behavior where threat actors leverage newly identified malicious URLs from the Censys database to facilitate phishing campaigns or command-and-control communications within the network. A proactive hunt is essential in Azure Sentinel to immediately validate and block these high-severity indicators before they can compromise endpoints or exfiltrate sensitive data through unmonitored web traffic.

IOC Summary

Threat: censys Total URLs: 35 Active URLs: 32

URLStatusThreatDate Added
hxxp://103.161.17.92/bins/chud.x86onlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.x86_64offlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.ppconlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.mpslonlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.arm6onlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.aarch64onlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.arm7onlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.armonlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.arconlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.arm5onlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.m68konlinemalware_download2026-08-23
hxxp://103.161.17.92/bins/chud.mipsonlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.i686onlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.i486onlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.x86_64onlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.mipsonlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.powerpconlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.armv4lonlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.i586onlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.mipselonlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.armv6lonlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.armv7lonlinemalware_download2026-08-23
hxxp://2.27.248.13/AGbot.armv5lonlinemalware_download2026-08-23
hxxp://46.151.182.200/bot.i468offlinemalware_download2026-08-23
hxxp://46.151.182.200/x86_64onlinemalware_download2026-08-23

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: censys
let malicious_domains = dynamic(["2.27.248.13", "103.161.17.92", "185.104.63.79", "46.151.182.200", "193.111.117.135"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["2.27.248.13", "103.161.17.92", "185.104.63.79", "46.151.182.200", "193.111.117.135"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: censys Malicious URLs rule, including tailored filters and exclusions suitable for an enterprise environment:

Original source: https://urlhaus.abuse.ch/