← Back to SOC feed Coverage →

URLhaus: Mozi Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-25T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects adversary behavior where attackers leverage Mozi-tagged malicious URLs to deliver payloads that may compromise endpoints through web-based threats. A SOC team should proactively hunt for these indicators in Azure Sentinel because Mozi’s reputation as a sophisticated threat actor necessitates early identification of its evolving URL infrastructure to prevent potential lateral movement and data exfiltration.

IOC Summary

Threat: Mozi Total URLs: 42 Active URLs: 42

URLStatusThreatDate Added
hxxp://123.14.217.252:58040/bin.shonlinemalware_download2026-08-25
hxxp://42.231.182.127:42828/ionlinemalware_download2026-08-25
hxxp://182.114.48.35:56580/bin.shonlinemalware_download2026-08-25
hxxp://182.127.42.125:50556/ionlinemalware_download2026-08-25
hxxp://123.9.80.236:60059/ionlinemalware_download2026-08-25
hxxp://27.206.151.130:55378/bin.shonlinemalware_download2026-08-25
hxxp://42.224.122.200:55867/bin.shonlinemalware_download2026-08-25
hxxp://182.123.210.95:48050/ionlinemalware_download2026-08-25
hxxp://222.141.36.152:36990/ionlinemalware_download2026-08-25
hxxp://115.50.224.166:50810/ionlinemalware_download2026-08-25
hxxp://115.62.159.162:33981/ionlinemalware_download2026-08-25
hxxp://123.5.170.227:57371/ionlinemalware_download2026-08-25
hxxp://42.224.122.200:55867/ionlinemalware_download2026-08-25
hxxp://115.57.229.170:49217/ionlinemalware_download2026-08-25
hxxp://61.52.215.65:33601/bin.shonlinemalware_download2026-08-25
hxxp://221.15.193.147:56368/bin.shonlinemalware_download2026-08-25
hxxp://125.44.62.105:40766/bin.shonlinemalware_download2026-08-25
hxxp://219.157.182.229:47636/bin.shonlinemalware_download2026-08-25
hxxp://125.43.45.65:55210/ionlinemalware_download2026-08-25
hxxp://222.140.185.20:49795/bin.shonlinemalware_download2026-08-25
hxxp://123.4.198.85:59307/ionlinemalware_download2026-08-25
hxxp://182.127.112.52:54660/ionlinemalware_download2026-08-25
hxxp://103.203.210.102:53995/ionlinemalware_download2026-08-25
hxxp://61.52.78.61:46235/bin.shonlinemalware_download2026-08-25
hxxp://115.57.123.19:54898/ionlinemalware_download2026-08-25

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.114.48.35", "125.44.62.105", "61.52.215.65", "125.43.45.65", "221.15.193.147", "182.127.42.125", "123.9.80.236", "115.62.159.162", "39.79.144.82", "123.14.217.252", "182.127.112.52", "222.140.185.20", "123.11.96.137", "125.42.76.153", "115.50.224.166", "103.203.210.102", "42.231.182.127", "27.206.151.130", "123.5.170.227", "42.224.122.200", "81.227.54.149", "123.4.198.85", "115.57.229.170", "61.52.78.61", "219.157.182.229", "182.123.210.95", "115.57.123.19", "222.141.36.152", "87.68.238.101"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.114.48.35", "125.44.62.105", "61.52.215.65", "125.43.45.65", "221.15.193.147", "182.127.42.125", "123.9.80.236", "115.62.159.162", "39.79.144.82", "123.14.217.252", "182.127.112.52", "222.140.185.20", "123.11.96.137", "125.42.76.153", "115.50.224.166", "103.203.210.102", "42.231.182.127", "27.206.151.130", "123.5.170.227", "42.224.122.200", "81.227.54.149", "123.4.198.85", "115.57.229.170", "61.52.78.61", "219.157.182.229", "182.123.210.95", "115.57.123.19", "222.141.36.152", "87.68.238.101"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://urlhaus.abuse.ch/