← Back to SOC feed Coverage →

URLhaus: Mozi Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-22T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving the Mozi malware family by monitoring network traffic against a curated list of 22 known malicious URLs to catch early-stage infection vectors. Proactive hunting for these indicators in Azure Sentinel is critical because Mozi’s ability to deploy via web-based delivery mechanisms allows attackers to establish persistence and exfiltrate data before traditional endpoint defenses trigger alerts.

IOC Summary

Threat: Mozi Total URLs: 22 Active URLs: 22

URLStatusThreatDate Added
hxxp://87.68.238.27:33808/bin.shonlinemalware_download2026-08-22
hxxp://115.49.24.80:42107/ionlinemalware_download2026-08-22
hxxp://174.105.154.212:55690/ionlinemalware_download2026-08-22
hxxp://125.43.20.178:46432/ionlinemalware_download2026-08-22
hxxp://87.68.238.27:33808/ionlinemalware_download2026-08-22
hxxp://125.47.246.199:52106/ionlinemalware_download2026-08-22
hxxp://182.126.201.118:34655/ionlinemalware_download2026-08-22
hxxp://125.44.39.164:59869/ionlinemalware_download2026-08-22
hxxp://182.113.34.181:57854/ionlinemalware_download2026-08-22
hxxp://123.14.82.47:47055/ionlinemalware_download2026-08-22
hxxp://181.79.85.69:11861/ionlinemalware_download2026-08-22
hxxp://42.228.221.46:33013/ionlinemalware_download2026-08-22
hxxp://182.113.35.84:54017/ionlinemalware_download2026-08-22
hxxp://45.194.25.221:57073/ionlinemalware_download2026-08-22
hxxp://203.101.187.14:53741/bin.shonlinemalware_download2026-08-22
hxxp://27.202.245.161:52186/bin.shonlinemalware_download2026-08-22
hxxp://42.231.79.131:52303/bin.shonlinemalware_download2026-08-22
hxxp://43.245.39.127:54225/ionlinemalware_download2026-08-22
hxxp://61.163.131.68:44551/bin.shonlinemalware_download2026-08-22
hxxp://42.228.221.46:33013/bin.shonlinemalware_download2026-08-22
hxxp://203.101.187.14:53741/ionlinemalware_download2026-08-22
hxxp://112.248.189.106:45073/ionlinemalware_download2026-08-22

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.113.35.84", "181.79.85.69", "182.126.201.118", "125.44.39.164", "87.68.238.27", "45.194.25.221", "203.101.187.14", "112.248.189.106", "42.228.221.46", "123.14.82.47", "43.245.39.127", "115.49.24.80", "125.47.246.199", "61.163.131.68", "27.202.245.161", "125.43.20.178", "42.231.79.131", "174.105.154.212", "182.113.34.181"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.113.35.84", "181.79.85.69", "182.126.201.118", "125.44.39.164", "87.68.238.27", "45.194.25.221", "203.101.187.14", "112.248.189.106", "42.228.221.46", "123.14.82.47", "43.245.39.127", "115.49.24.80", "125.47.246.199", "61.163.131.68", "27.202.245.161", "125.43.20.178", "42.231.79.131", "174.105.154.212", "182.113.34.181"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/