← Back to SOC feed Coverage →

URLhaus: mirai Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-15T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects adversary behavior involving traffic to known Mirai botnet command-and-control or infection sources identified by URLhaus, which are frequently used to compromise IoT devices and initiate large-scale DDoS attacks. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify early-stage infections within their network perimeter and prevent the lateral spread of Mirai variants before they can orchestrate significant disruption.

IOC Summary

Threat: mirai Total URLs: 24 Active URLs: 24

URLStatusThreatDate Added
hxxp://115.197.32.42:36155/ionlinemalware_download2026-08-15
hxxp://36.70.226.107:53300/ionlinemalware_download2026-08-15
hxxp://182.240.11.199:57352/ionlinemalware_download2026-08-15
hxxp://200.115.102.246:32939/ionlinemalware_download2026-08-15
hxxp://115.230.79.157:47435/bin.shonlinemalware_download2026-08-15
hxxp://83.168.69.141/p1.shonlinemalware_download2026-08-15
hxxp://110.37.22.216:55052/ionlinemalware_download2026-08-15
hxxp://110.37.44.119:37578/bin.shonlinemalware_download2026-08-15
hxxp://196.189.35.226:40707/ionlinemalware_download2026-08-15
hxxp://183.23.133.4:35951/bin.shonlinemalware_download2026-08-15
hxxp://116.53.20.49:42959/ionlinemalware_download2026-08-15
hxxp://110.37.44.119:37578/ionlinemalware_download2026-08-15
hxxp://182.129.144.219:54088/ionlinemalware_download2026-08-15
hxxp://210.208.110.130:40967/bin.shonlinemalware_download2026-08-15
hxxp://124.235.207.2:39666/ionlinemalware_download2026-08-15
hxxp://27.156.139.177:51830/ionlinemalware_download2026-08-15
hxxp://123.185.91.133:52353/bin.shonlinemalware_download2026-08-15
hxxp://182.85.43.191:49489/ionlinemalware_download2026-08-15
hxxp://140.237.44.234:41542/bin.shonlinemalware_download2026-08-15
hxxp://140.237.44.234:41542/ionlinemalware_download2026-08-15
hxxp://27.156.139.177:51830/bin.shonlinemalware_download2026-08-15
hxxp://182.85.43.191:49489/bin.shonlinemalware_download2026-08-15
hxxp://79.106.74.167:44091/ionlinemalware_download2026-08-15
hxxp://196.189.35.226:40707/bin.shonlinemalware_download2026-08-15

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["182.129.144.219", "200.115.102.246", "115.230.79.157", "182.85.43.191", "36.70.226.107", "116.53.20.49", "83.168.69.141", "182.240.11.199", "140.237.44.234", "210.208.110.130", "123.185.91.133", "110.37.44.119", "124.235.207.2", "196.189.35.226", "183.23.133.4", "79.106.74.167", "115.197.32.42", "27.156.139.177", "110.37.22.216"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.129.144.219", "200.115.102.246", "115.230.79.157", "182.85.43.191", "36.70.226.107", "116.53.20.49", "83.168.69.141", "182.240.11.199", "140.237.44.234", "210.208.110.130", "123.185.91.133", "110.37.44.119", "124.235.207.2", "196.189.35.226", "183.23.133.4", "79.106.74.167", "115.197.32.42", "27.156.139.177", "110.37.22.216"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Original source: https://urlhaus.abuse.ch/