This hunt detects adversary behavior where threat actors leverage Mozi-tagged malicious URLs to deliver payloads that compromise endpoint integrity and initiate command-and-control communications. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of Mozi-associated traffic enables rapid containment of potential supply chain or web-browsing attacks before they escalate into broader network incidents.
Threat: Mozi Total URLs: 40 Active URLs: 40
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://61.52.216.153:49651/i | online | malware_download | 2026-08-28 |
hxxp://42.227.238.137:55865/i | online | malware_download | 2026-08-28 |
hxxp://95.220.126.209:47353/Mozi.m | online | malware_download | 2026-08-28 |
hxxp://61.52.216.153:49651/bin.sh | online | malware_download | 2026-08-28 |
hxxp://81.227.54.149:33012/i | online | malware_download | 2026-08-28 |
hxxp://42.227.202.96:55789/i | online | malware_download | 2026-08-28 |
hxxp://87.68.238.101:49479/bin.sh | online | malware_download | 2026-08-28 |
hxxp://59.96.139.218:45093/i | online | malware_download | 2026-08-28 |
hxxp://59.96.139.218:45093/bin.sh | online | malware_download | 2026-08-28 |
hxxp://42.235.90.191:55867/i | online | malware_download | 2026-08-28 |
hxxp://78.187.104.169:47307/i | online | malware_download | 2026-08-28 |
hxxp://46.236.65.160:41635/i | online | malware_download | 2026-08-28 |
hxxp://115.62.150.76:34902/i | online | malware_download | 2026-08-28 |
hxxp://123.11.2.109:37624/i | online | malware_download | 2026-08-28 |
hxxp://182.121.47.7:45549/i | online | malware_download | 2026-08-28 |
hxxp://182.122.238.136:47112/i | online | malware_download | 2026-08-28 |
hxxp://219.155.209.76:34329/bin.sh | online | malware_download | 2026-08-28 |
hxxp://115.55.251.79:51874/i | online | malware_download | 2026-08-28 |
hxxp://182.127.29.73:53517/i | online | malware_download | 2026-08-28 |
hxxp://112.238.146.18:59385/bin.sh | online | malware_download | 2026-08-28 |
hxxp://113.71.156.197:37821/i | online | malware_download | 2026-08-28 |
hxxp://103.146.110.126:43184/i | online | malware_download | 2026-08-28 |
hxxp://113.71.156.197:37821/bin.sh | online | malware_download | 2026-08-28 |
hxxp://222.142.250.89:48058/i | online | malware_download | 2026-08-28 |
hxxp://115.55.49.200:56543/i | online | malware_download | 2026-08-28 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.126.125.52", "103.146.110.126", "59.96.139.218", "115.62.150.76", "115.55.251.79", "115.55.49.200", "42.224.99.104", "115.56.46.185", "182.127.29.73", "123.11.78.158", "182.122.238.136", "42.227.202.96", "219.155.209.76", "42.235.90.191", "42.227.238.137", "113.71.156.197", "182.124.178.175", "78.187.104.169", "87.68.238.101", "46.236.65.160", "61.52.216.153", "222.142.250.89", "123.11.2.109", "81.227.54.149", "95.220.126.209", "112.238.146.18", "182.121.47.7"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.125.52", "103.146.110.126", "59.96.139.218", "115.62.150.76", "115.55.251.79", "115.55.49.200", "42.224.99.104", "115.56.46.185", "182.127.29.73", "123.11.78.158", "182.122.238.136", "42.227.202.96", "219.155.209.76", "42.235.90.191", "42.227.238.137", "113.71.156.197", "182.124.178.175", "78.187.104.169", "87.68.238.101", "46.236.65.160", "61.52.216.153", "222.142.250.89", "123.11.2.109", "81.227.54.149", "95.220.126.209", "112.238.146.18", "182.121.47.7"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 3-5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including targeted filters and exclusions:
Scenario: Automated Software Update Scans by Endpoint Protection Agents
Source Process Name. Exclude alerts where the process is C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or C:\Windows\System32\smss.exe (for Windows Update services) connecting to known Mozi URLs, provided the connection duration is under 5 seconds and no data payload download occurs.Scenario: Scheduled Backup Jobs Accessing Cloud Storage Gateways
Source Host belongs to the “Backup-Server” OU (Organizational Unit) or IP range, specifically targeting URLs ending in .s3.amazonaws.com or specific vendor CDN domains known to host Mozi feeds.Scenario: Security Information and Event Management (SIEM) Ingestion Polling