← Back to SOC feed Coverage →

URLhaus: mirai Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-25T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects the initial infection phase of Mirai malware, where compromised IoT devices communicate with known malicious URLs to establish command-and-control channels or download payloads for botnet recruitment. Proactively hunting for these URL interactions in Azure Sentinel is critical to identify early-stage compromises before they escalate into large-scale DDoS attacks that can overwhelm network infrastructure and disrupt business operations.

IOC Summary

Threat: mirai Total URLs: 23 Active URLs: 23

URLStatusThreatDate Added
hxxp://210.208.111.100:60334/ionlinemalware_download2026-08-25
hxxp://180.116.151.75:50936/ionlinemalware_download2026-08-25
hxxp://183.23.136.185:35951/ionlinemalware_download2026-08-25
hxxp://210.208.111.74:41375/bin.shonlinemalware_download2026-08-25
hxxp://210.208.110.172:38919/ionlinemalware_download2026-08-25
hxxp://180.252.217.7:57217/ionlinemalware_download2026-08-25
hxxp://123.185.64.34:36611/ionlinemalware_download2026-08-25
hxxp://120.28.189.248:56580/ionlinemalware_download2026-08-25
hxxp://222.127.53.189:51312/bin.shonlinemalware_download2026-08-25
hxxp://115.50.238.131:51347/ionlinemalware_download2026-08-25
hxxp://115.58.181.133:33235/bin.shonlinemalware_download2026-08-25
hxxp://119.179.30.73:48215/ionlinemalware_download2026-08-25
hxxp://36.69.73.14:48649/ionlinemalware_download2026-08-25
hxxp://115.50.238.131:51347/bin.shonlinemalware_download2026-08-25
hxxp://115.206.176.178:48491/ionlinemalware_download2026-08-25
hxxp://210.208.110.20:51160/ionlinemalware_download2026-08-25
hxxp://105.186.99.161:34643/ionlinemalware_download2026-08-25
hxxp://113.221.47.252:58353/bin.shonlinemalware_download2026-08-25
hxxp://210.208.111.220:49419/ionlinemalware_download2026-08-25
hxxp://36.69.73.14:48649/bin.shonlinemalware_download2026-08-25
hxxp://36.251.0.100:33623/ionlinemalware_download2026-08-25
hxxp://222.127.53.189:51312/ionlinemalware_download2026-08-25
hxxp://210.208.111.74:41375/ionlinemalware_download2026-08-25

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["119.179.30.73", "210.208.110.172", "123.185.64.34", "113.221.47.252", "180.116.151.75", "115.50.238.131", "36.251.0.100", "183.23.136.185", "222.127.53.189", "36.69.73.14", "210.208.111.74", "115.58.181.133", "105.186.99.161", "115.206.176.178", "120.28.189.248", "180.252.217.7", "210.208.110.20", "210.208.111.100", "210.208.111.220"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["119.179.30.73", "210.208.110.172", "123.185.64.34", "113.221.47.252", "180.116.151.75", "115.50.238.131", "36.251.0.100", "183.23.136.185", "222.127.53.189", "36.69.73.14", "210.208.111.74", "115.58.181.133", "105.186.99.161", "115.206.176.178", "120.28.189.248", "180.252.217.7", "210.208.110.20", "210.208.111.100", "210.208.111.220"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

False Positive Scenarios: URLhaus: mirai Malicious URLs

Original source: https://urlhaus.abuse.ch/