← Back to SOC feed Coverage →

URLhaus: Mozi Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-28T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects adversary behavior where threat actors leverage Mozi-tagged malicious URLs to deliver payloads that compromise endpoint integrity and initiate command-and-control communications. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of Mozi-associated traffic enables rapid containment of potential supply chain or web-browsing attacks before they escalate into broader network incidents.

IOC Summary

Threat: Mozi Total URLs: 40 Active URLs: 40

URLStatusThreatDate Added
hxxp://61.52.216.153:49651/ionlinemalware_download2026-08-28
hxxp://42.227.238.137:55865/ionlinemalware_download2026-08-28
hxxp://95.220.126.209:47353/Mozi.monlinemalware_download2026-08-28
hxxp://61.52.216.153:49651/bin.shonlinemalware_download2026-08-28
hxxp://81.227.54.149:33012/ionlinemalware_download2026-08-28
hxxp://42.227.202.96:55789/ionlinemalware_download2026-08-28
hxxp://87.68.238.101:49479/bin.shonlinemalware_download2026-08-28
hxxp://59.96.139.218:45093/ionlinemalware_download2026-08-28
hxxp://59.96.139.218:45093/bin.shonlinemalware_download2026-08-28
hxxp://42.235.90.191:55867/ionlinemalware_download2026-08-28
hxxp://78.187.104.169:47307/ionlinemalware_download2026-08-28
hxxp://46.236.65.160:41635/ionlinemalware_download2026-08-28
hxxp://115.62.150.76:34902/ionlinemalware_download2026-08-28
hxxp://123.11.2.109:37624/ionlinemalware_download2026-08-28
hxxp://182.121.47.7:45549/ionlinemalware_download2026-08-28
hxxp://182.122.238.136:47112/ionlinemalware_download2026-08-28
hxxp://219.155.209.76:34329/bin.shonlinemalware_download2026-08-28
hxxp://115.55.251.79:51874/ionlinemalware_download2026-08-28
hxxp://182.127.29.73:53517/ionlinemalware_download2026-08-28
hxxp://112.238.146.18:59385/bin.shonlinemalware_download2026-08-28
hxxp://113.71.156.197:37821/ionlinemalware_download2026-08-28
hxxp://103.146.110.126:43184/ionlinemalware_download2026-08-28
hxxp://113.71.156.197:37821/bin.shonlinemalware_download2026-08-28
hxxp://222.142.250.89:48058/ionlinemalware_download2026-08-28
hxxp://115.55.49.200:56543/ionlinemalware_download2026-08-28

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.126.125.52", "103.146.110.126", "59.96.139.218", "115.62.150.76", "115.55.251.79", "115.55.49.200", "42.224.99.104", "115.56.46.185", "182.127.29.73", "123.11.78.158", "182.122.238.136", "42.227.202.96", "219.155.209.76", "42.235.90.191", "42.227.238.137", "113.71.156.197", "182.124.178.175", "78.187.104.169", "87.68.238.101", "46.236.65.160", "61.52.216.153", "222.142.250.89", "123.11.2.109", "81.227.54.149", "95.220.126.209", "112.238.146.18", "182.121.47.7"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.125.52", "103.146.110.126", "59.96.139.218", "115.62.150.76", "115.55.251.79", "115.55.49.200", "42.224.99.104", "115.56.46.185", "182.127.29.73", "123.11.78.158", "182.122.238.136", "42.227.202.96", "219.155.209.76", "42.235.90.191", "42.227.238.137", "113.71.156.197", "182.124.178.175", "78.187.104.169", "87.68.238.101", "46.236.65.160", "61.52.216.153", "222.142.250.89", "123.11.2.109", "81.227.54.149", "95.220.126.209", "112.238.146.18", "182.121.47.7"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including targeted filters and exclusions:

Original source: https://urlhaus.abuse.ch/