← Back to SOC feed Coverage →

URLhaus: Mozi Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-16T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving the Mozi malware family by monitoring network traffic against a curated list of 37 known malicious URLs to capture initial infection vectors or command-and-control communications. Proactive hunting for these indicators in Azure Sentinel is critical because Mozi’s high-severity threat profile necessitates early identification to prevent lateral movement and data exfiltration before the adversary establishes persistence within the environment.

IOC Summary

Threat: Mozi Total URLs: 37 Active URLs: 37

URLStatusThreatDate Added
hxxp://112.248.252.55:54907/ionlinemalware_download2026-08-16
hxxp://61.53.205.176:60240/bin.shonlinemalware_download2026-08-16
hxxp://182.121.83.219:37581/ionlinemalware_download2026-08-16
hxxp://222.137.152.55:53457/bin.shonlinemalware_download2026-08-16
hxxp://182.121.244.13:44914/bin.shonlinemalware_download2026-08-16
hxxp://59.96.142.124:33142/bin.shonlinemalware_download2026-08-16
hxxp://222.141.21.106:38226/bin.shonlinemalware_download2026-08-16
hxxp://182.121.83.219:37581/bin.shonlinemalware_download2026-08-16
hxxp://219.155.171.135:36711/bin.shonlinemalware_download2026-08-16
hxxp://219.155.171.135:36711/ionlinemalware_download2026-08-16
hxxp://182.126.84.239:35309/bin.shonlinemalware_download2026-08-16
hxxp://110.36.80.162:54439/ionlinemalware_download2026-08-16
hxxp://203.2.151.15:42459/bin.shonlinemalware_download2026-08-16
hxxp://125.41.247.59:53378/bin.shonlinemalware_download2026-08-16
hxxp://222.137.152.55:53457/ionlinemalware_download2026-08-16
hxxp://123.11.72.175:34884/bin.shonlinemalware_download2026-08-16
hxxp://123.11.72.175:34884/ionlinemalware_download2026-08-16
hxxp://182.114.192.138:40709/ionlinemalware_download2026-08-16
hxxp://182.126.84.239:35309/ionlinemalware_download2026-08-16
hxxp://124.131.128.79:53693/bin.shonlinemalware_download2026-08-16
hxxp://115.55.130.218:47315/ionlinemalware_download2026-08-16
hxxp://103.179.240.227:36804/bin.shonlinemalware_download2026-08-16
hxxp://110.36.86.0:40490/bin.shonlinemalware_download2026-08-16
hxxp://124.131.128.79:53693/ionlinemalware_download2026-08-16
hxxp://125.41.247.59:53378/ionlinemalware_download2026-08-16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["39.73.126.17", "182.121.83.219", "219.155.171.135", "59.96.142.124", "115.55.130.240", "61.53.205.176", "182.114.192.138", "182.126.84.239", "182.121.244.13", "125.41.247.59", "125.41.228.213", "203.2.151.15", "124.131.128.79", "110.36.80.162", "115.55.130.218", "110.36.86.0", "103.179.240.227", "222.141.21.106", "125.42.65.22", "123.11.72.175", "83.219.1.198", "112.248.252.55", "222.137.152.55"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["39.73.126.17", "182.121.83.219", "219.155.171.135", "59.96.142.124", "115.55.130.240", "61.53.205.176", "182.114.192.138", "182.126.84.239", "182.121.244.13", "125.41.247.59", "125.41.228.213", "203.2.151.15", "124.131.128.79", "110.36.80.162", "115.55.130.218", "110.36.86.0", "103.179.240.227", "222.141.21.106", "125.42.65.22", "123.11.72.175", "83.219.1.198", "112.248.252.55", "222.137.152.55"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://urlhaus.abuse.ch/