This detection identifies adversary activity involving the Mozi malware family by monitoring network traffic against a curated list of 22 known malicious URLs to catch early-stage infection vectors. Proactive hunting for these indicators in Azure Sentinel is critical because Mozi’s ability to deploy via web-based delivery mechanisms allows attackers to establish persistence and exfiltrate data before traditional endpoint defenses trigger alerts.
Threat: Mozi Total URLs: 22 Active URLs: 22
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://87.68.238.27:33808/bin.sh | online | malware_download | 2026-08-22 |
hxxp://115.49.24.80:42107/i | online | malware_download | 2026-08-22 |
hxxp://174.105.154.212:55690/i | online | malware_download | 2026-08-22 |
hxxp://125.43.20.178:46432/i | online | malware_download | 2026-08-22 |
hxxp://87.68.238.27:33808/i | online | malware_download | 2026-08-22 |
hxxp://125.47.246.199:52106/i | online | malware_download | 2026-08-22 |
hxxp://182.126.201.118:34655/i | online | malware_download | 2026-08-22 |
hxxp://125.44.39.164:59869/i | online | malware_download | 2026-08-22 |
hxxp://182.113.34.181:57854/i | online | malware_download | 2026-08-22 |
hxxp://123.14.82.47:47055/i | online | malware_download | 2026-08-22 |
hxxp://181.79.85.69:11861/i | online | malware_download | 2026-08-22 |
hxxp://42.228.221.46:33013/i | online | malware_download | 2026-08-22 |
hxxp://182.113.35.84:54017/i | online | malware_download | 2026-08-22 |
hxxp://45.194.25.221:57073/i | online | malware_download | 2026-08-22 |
hxxp://203.101.187.14:53741/bin.sh | online | malware_download | 2026-08-22 |
hxxp://27.202.245.161:52186/bin.sh | online | malware_download | 2026-08-22 |
hxxp://42.231.79.131:52303/bin.sh | online | malware_download | 2026-08-22 |
hxxp://43.245.39.127:54225/i | online | malware_download | 2026-08-22 |
hxxp://61.163.131.68:44551/bin.sh | online | malware_download | 2026-08-22 |
hxxp://42.228.221.46:33013/bin.sh | online | malware_download | 2026-08-22 |
hxxp://203.101.187.14:53741/i | online | malware_download | 2026-08-22 |
hxxp://112.248.189.106:45073/i | online | malware_download | 2026-08-22 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.113.35.84", "181.79.85.69", "182.126.201.118", "125.44.39.164", "87.68.238.27", "45.194.25.221", "203.101.187.14", "112.248.189.106", "42.228.221.46", "123.14.82.47", "43.245.39.127", "115.49.24.80", "125.47.246.199", "61.163.131.68", "27.202.245.161", "125.43.20.178", "42.231.79.131", "174.105.154.212", "182.113.34.181"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.113.35.84", "181.79.85.69", "182.126.201.118", "125.44.39.164", "87.68.238.27", "45.194.25.221", "203.101.187.14", "112.248.189.106", "42.228.221.46", "123.14.82.47", "43.245.39.127", "115.49.24.80", "125.47.246.199", "61.163.131.68", "27.202.245.161", "125.43.20.178", "42.231.79.131", "174.105.154.212", "182.113.34.181"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: Automated vulnerability scanning by Tenable Nessus or Qualys agents performing daily web server assessments against internal development environments that host legacy Mozi-based microservices.
10.20.50.x) and restrict the detection to exclude traffic destined for known internal subnets where Mozi development instances reside, rather than external public URLs.Scenario: Scheduled nightly backup jobs executed by Veeam Backup & Replication agents that query a centralized configuration repository hosted on an internal Mozi server to verify artifact integrity before archiving.
svc-veeam-backup) accessing the known internal Mozi repository hostname, ensuring alerts only trigger outside these maintenance windows.Scenario: Legitimate CI/CD pipeline runs in Jenkins or GitLab Runner environments where build agents pull dependencies from an internal artifact registry that utilizes a Mozi-compatible URL structure for package manifests.
artifacts.internal-corp.com) to the allow-list and filter out traffic initiated by the specific build agent service accounts (jenkins-agent-01, gitlab-runner-prod).Scenario: Enterprise-wide email security gateway (Proofpoint or Microsoft Defender for Office 365) performing real-time URL reputation checks on internal links shared via SharePoint intranet pages that embed Mozi-powered widgets.