This hunt identifies potential Mozi botnet infections by correlating network traffic with known malicious URLs, targeting the initial compromise or command-and-control channels used by this prevalent IoT and enterprise malware. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect lateral movement or external communication attempts before the botnet can fully establish its presence and propagate across the environment.
Threat: Mozi Total URLs: 38 Active URLs: 38
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://221.15.145.135:55618/i | online | malware_download | 2026-09-14 |
hxxp://222.140.186.92:44887/i | online | malware_download | 2026-09-14 |
hxxp://42.228.100.168:59474/i | online | malware_download | 2026-09-14 |
hxxp://221.1.226.101:54476/bin.sh | online | malware_download | 2026-09-14 |
hxxp://221.15.14.221:57481/bin.sh | online | malware_download | 2026-09-14 |
hxxp://221.13.249.38:40896/i | online | malware_download | 2026-09-14 |
hxxp://42.231.45.174:46469/i | online | malware_download | 2026-09-14 |
hxxp://42.231.45.174:46469/bin.sh | online | malware_download | 2026-09-14 |
hxxp://42.231.110.122:58966/i | online | malware_download | 2026-09-14 |
hxxp://222.142.247.71:51781/i | online | malware_download | 2026-09-14 |
hxxp://222.142.247.71:51781/bin.sh | online | malware_download | 2026-09-14 |
hxxp://221.15.14.221:57481/i | online | malware_download | 2026-09-14 |
hxxp://39.187.82.248:50808/i | online | malware_download | 2026-09-14 |
hxxp://39.90.149.36:39098/bin.sh | online | malware_download | 2026-09-14 |
hxxp://61.52.184.186:37650/bin.sh | online | malware_download | 2026-09-14 |
hxxp://39.90.149.36:39098/i | online | malware_download | 2026-09-14 |
hxxp://39.74.99.225:43107/bin.sh | online | malware_download | 2026-09-14 |
hxxp://39.74.99.225:43107/i | online | malware_download | 2026-09-14 |
hxxp://61.52.184.186:37650/i | online | malware_download | 2026-09-14 |
hxxp://115.57.255.35:52731/i | online | malware_download | 2026-09-14 |
hxxp://115.58.85.188:55703/i | online | malware_download | 2026-09-14 |
hxxp://182.126.104.49:44847/i | online | malware_download | 2026-09-14 |
hxxp://115.50.144.233:34188/bin.sh | online | malware_download | 2026-09-14 |
hxxp://115.50.144.233:34188/i | online | malware_download | 2026-09-14 |
hxxp://182.117.0.68:36879/bin.sh | online | malware_download | 2026-09-14 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.127.71.87", "125.41.204.131", "61.52.184.186", "222.142.247.71", "115.57.255.35", "42.231.45.174", "39.187.82.248", "121.231.77.20", "42.228.100.168", "115.58.85.188", "162.246.27.201", "222.140.186.92", "115.50.144.233", "182.117.0.68", "221.1.226.101", "221.15.14.221", "221.15.145.135", "39.90.149.36", "182.126.104.49", "42.231.110.122", "39.74.99.225", "221.13.249.38"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.127.71.87", "125.41.204.131", "61.52.184.186", "222.142.247.71", "115.57.255.35", "42.231.45.174", "39.187.82.248", "121.231.77.20", "42.228.100.168", "115.58.85.188", "162.246.27.201", "222.140.186.92", "115.50.144.233", "182.117.0.68", "221.1.226.101", "221.15.14.221", "221.15.145.135", "39.90.149.36", "182.126.104.49", "42.231.110.122", "39.74.99.225", "221.13.249.38"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
java.exe for Jenkins, node.exe for GitLab runners) or filter by user accounts ending in _ci or _bot.nessus.exe, qualys_agent.exe) or filter by hostnames in the staging or test subdomains.Mozilla and the request originates from browser processes (chrome.exe, msedge.exe, firefox.exe) if the URL path includes version-specific identifiers (e.g., /v2.1.0/).