← Back to SOC feed Coverage →

URLhaus: Mozi Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-29T11:00:00Z · Confidence: medium

Hunt Hypothesis

This rule detects adversary behavior involving the exploitation of Mozi-tagged malicious URLs to deliver payloads that compromise endpoint integrity within the network. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of Mozi-associated traffic allows for rapid containment before lateral movement or data exfiltration occurs.

IOC Summary

Threat: Mozi Total URLs: 46 Active URLs: 46

URLStatusThreatDate Added
hxxp://221.15.7.244:38891/ionlinemalware_download2026-08-29
hxxp://42.234.233.72:38508/bin.shonlinemalware_download2026-08-29
hxxp://125.41.6.152:46245/bin.shonlinemalware_download2026-08-29
hxxp://182.126.204.148:48244/bin.shonlinemalware_download2026-08-29
hxxp://171.125.204.163:12907/ionlinemalware_download2026-08-29
hxxp://115.60.208.32:52950/ionlinemalware_download2026-08-29
hxxp://125.47.92.240:35468/bin.shonlinemalware_download2026-08-29
hxxp://112.239.123.90:59150/bin.shonlinemalware_download2026-08-29
hxxp://182.116.118.56:58412/ionlinemalware_download2026-08-29
hxxp://42.227.238.137:55865/bin.shonlinemalware_download2026-08-29
hxxp://123.12.195.221:46881/bin.shonlinemalware_download2026-08-29
hxxp://115.58.93.144:55797/ionlinemalware_download2026-08-29
hxxp://171.125.204.163:12907/bin.shonlinemalware_download2026-08-29
hxxp://115.60.208.32:52950/bin.shonlinemalware_download2026-08-29
hxxp://124.131.158.244:55504/ionlinemalware_download2026-08-29
hxxp://222.138.101.213:34074/bin.shonlinemalware_download2026-08-29
hxxp://115.50.1.231:33440/bin.shonlinemalware_download2026-08-29
hxxp://123.9.242.26:52522/ionlinemalware_download2026-08-29
hxxp://119.179.248.180:39560/ionlinemalware_download2026-08-29
hxxp://222.139.194.121:37916/bin.shonlinemalware_download2026-08-29
hxxp://115.49.232.111:48058/ionlinemalware_download2026-08-29
hxxp://182.127.121.121:54660/bin.shonlinemalware_download2026-08-29
hxxp://182.116.55.159:32934/bin.shonlinemalware_download2026-08-29
hxxp://222.141.75.2:47007/ionlinemalware_download2026-08-29
hxxp://222.141.112.133:41245/ionlinemalware_download2026-08-29

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["123.12.195.221", "112.239.123.90", "182.127.121.121", "182.116.55.159", "222.139.194.121", "182.116.118.56", "115.49.232.111", "125.47.92.240", "42.227.238.137", "222.138.101.213", "119.179.248.180", "124.131.158.244", "115.58.93.144", "115.50.1.231", "115.63.241.158", "222.141.112.133", "222.141.75.2", "42.234.233.72", "125.41.6.152", "182.126.204.148", "182.126.141.140", "115.60.208.32", "123.9.242.26", "221.15.7.244", "171.125.204.163"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.12.195.221", "112.239.123.90", "182.127.121.121", "182.116.55.159", "222.139.194.121", "182.116.118.56", "115.49.232.111", "125.47.92.240", "42.227.238.137", "222.138.101.213", "119.179.248.180", "124.131.158.244", "115.58.93.144", "115.50.1.231", "115.63.241.158", "222.141.112.133", "222.141.75.2", "42.234.233.72", "125.41.6.152", "182.126.204.148", "182.126.141.140", "115.60.208.32", "123.9.242.26", "221.15.7.244", "171.125.204.163"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding filters for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment:

Original source: https://urlhaus.abuse.ch/