← Back to SOC feed Coverage →

URLhaus: mirai Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-09-09T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis targets the presence of known Mirai botnet command-and-control (C2) URLs in network traffic, indicating potential IoT or server compromise by a widespread malware family. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify infected assets early, preventing lateral movement and ensuring rapid containment of this high-severity threat.

IOC Summary

Threat: mirai Total URLs: 31 Active URLs: 31

URLStatusThreatDate Added
hxxp://172.233.43.198/bins/xnxnxnxnxnxnxnxnloongarch64xnxnonlinemalware_download2026-09-09
hxxp://172.233.43.198/bins/xnxnxnxnxnxnxnxnsh2xnxnonlinemalware_download2026-09-09
hxxp://172.233.43.198/bins/xnxnxnxnxnxnxnxnmipsxnxnonlinemalware_download2026-09-09
hxxp://172.233.43.198/bins/xnxnxnxnxnxnxnxnmicroblazexnxnonlinemalware_download2026-09-09
hxxp://172.233.43.198/bins/xnxnxnxnxnxnxnxnor1kxnxnonlinemalware_download2026-09-09
hxxp://172.233.43.198/bins/xnxnxnxnxnxnxnxnriscv64xnxnonlinemalware_download2026-09-09
hxxp://172.233.43.198/bins/xnxnxnxnxnxnxnxnsh4xnxnonlinemalware_download2026-09-09
hxxp://172.233.43.198/bins/xnxnxnxnxnxnxnxnm68kxnxnonlinemalware_download2026-09-09
hxxp://36.68.93.208:57750/ionlinemalware_download2026-09-09
hxxp://58.22.210.127:46509/ionlinemalware_download2026-09-09
hxxp://58.22.210.127:46509/bin.shonlinemalware_download2026-09-09
hxxp://38.58.200.25:40355/ionlinemalware_download2026-09-09
hxxp://221.3.87.188:42241/ionlinemalware_download2026-09-09
hxxp://196.189.69.192:45951/ionlinemalware_download2026-09-09
hxxp://180.191.49.27:47666/bin.shonlinemalware_download2026-09-09
hxxp://119.73.59.113:60742/bin.shonlinemalware_download2026-09-09
hxxp://114.198.242.174:38879/bin.shonlinemalware_download2026-09-09
hxxp://124.158.191.121:35084/ionlinemalware_download2026-09-09
hxxp://120.28.215.116:56895/bin.shonlinemalware_download2026-09-09
hxxp://221.3.87.188:42241/bin.shonlinemalware_download2026-09-09
hxxp://216.126.86.93:35535/ionlinemalware_download2026-09-09
hxxp://175.31.228.93:43869/ionlinemalware_download2026-09-09
hxxp://124.158.191.121:35084/bin.shonlinemalware_download2026-09-09
hxxp://120.28.215.36:39145/ionlinemalware_download2026-09-09
hxxp://210.208.110.172:46277/bin.shonlinemalware_download2026-09-09

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["38.58.200.25", "120.28.215.36", "221.3.87.188", "172.233.43.198", "120.28.215.116", "124.6.165.86", "124.158.191.121", "175.31.228.93", "115.59.231.52", "114.198.242.174", "120.28.219.231", "216.126.86.93", "58.22.210.127", "119.73.59.113", "196.189.69.192", "210.208.110.172", "210.208.110.20", "180.191.49.27", "36.68.93.208"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["38.58.200.25", "120.28.215.36", "221.3.87.188", "172.233.43.198", "120.28.215.116", "124.6.165.86", "124.158.191.121", "175.31.228.93", "115.59.231.52", "114.198.242.174", "120.28.219.231", "216.126.86.93", "58.22.210.127", "119.73.59.113", "196.189.69.192", "210.208.110.172", "210.208.110.20", "180.191.49.27", "36.68.93.208"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/