← Back to SOC feed Coverage →

URLhaus: mirai Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-09-28T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets the presence of known Mirai botnet URLs to identify hosts that may be compromised or actively communicating with command-and-control infrastructure. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect potential IoT or server compromises early, mitigating the risk of lateral movement and large-scale DDoS attacks before they impact the environment.

IOC Summary

Threat: mirai Total URLs: 50 Active URLs: 50

URLStatusThreatDate Added
hxxp://72.255.29.0:48689/ionlinemalware_download2026-09-28
hxxp://105.184.254.66:60011/ionlinemalware_download2026-09-28
hxxp://222.127.154.221:47475/bin.shonlinemalware_download2026-09-28
hxxp://58.47.110.140:42894/ionlinemalware_download2026-09-28
hxxp://105.184.254.66:60011/bin.shonlinemalware_download2026-09-28
hxxp://120.28.197.69:58427/ionlinemalware_download2026-09-28
hxxp://39.80.60.21:38015/ionlinemalware_download2026-09-28
hxxp://125.47.196.146:41326/ionlinemalware_download2026-09-28
hxxp://36.49.34.21:58287/ionlinemalware_download2026-09-28
hxxp://42.237.122.145:33277/ionlinemalware_download2026-09-28
hxxp://222.208.112.63:55111/ionlinemalware_download2026-09-28
hxxp://114.226.118.172:51491/ionlinemalware_download2026-09-28
hxxp://105.225.114.70:60879/ionlinemalware_download2026-09-28
hxxp://103.249.199.3:58152/ionlinemalware_download2026-09-28
hxxp://201.110.154.252:38216/ionlinemalware_download2026-09-28
hxxp://120.28.74.67:51454/ionlinemalware_download2026-09-28
hxxp://103.125.31.101:40307/ionlinemalware_download2026-09-28
hxxp://120.28.160.164:37922/ionlinemalware_download2026-09-28
hxxp://95.9.35.137:44778/bin.shonlinemalware_download2026-09-28
hxxp://dstats.qzz.io/x64sonlinemalware_download2026-09-28
hxxp://61.52.94.159:48113/ionlinemalware_download2026-09-28
hxxp://222.127.68.115:49760/bin.shonlinemalware_download2026-09-28
hxxp://dstats.qzz.io/arm7onlinemalware_download2026-09-28
hxxp://dstats.qzz.io/ayakashi2onlinemalware_download2026-09-28
hxxp://dstats.qzz.io/arm6onlinemalware_download2026-09-28

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["42.237.122.145", "120.28.197.69", "103.249.199.3", "120.28.160.164", "201.110.154.252", "61.52.94.159", "120.28.74.67", "crystalbranchtw.blog", "dstats.qzz.io", "222.127.154.221", "103.125.31.101", "222.208.112.63", "125.47.196.146", "222.127.68.115", "95.9.35.137", "72.255.29.0", "105.184.254.66", "36.49.34.21", "58.47.110.140", "39.80.60.21", "114.226.118.172", "105.225.114.70"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.237.122.145", "120.28.197.69", "103.249.199.3", "120.28.160.164", "201.110.154.252", "61.52.94.159", "120.28.74.67", "crystalbranchtw.blog", "dstats.qzz.io", "222.127.154.221", "103.125.31.101", "222.208.112.63", "125.47.196.146", "222.127.68.115", "95.9.35.137", "72.255.29.0", "105.184.254.66", "36.49.34.21", "58.47.110.140", "39.80.60.21", "114.226.118.172", "105.225.114.70"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/