← Back to SOC feed Coverage →

URLhaus: Mozi Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-17T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects adversary behavior where threat actors leverage Mozi-tagged malicious URLs to distribute malware and establish initial footholds within the network. The SOC team should proactively search for these indicators in Azure Sentinel to identify early-stage compromise vectors before they propagate across endpoints or exfiltrate sensitive data.

IOC Summary

Threat: Mozi Total URLs: 43 Active URLs: 43

URLStatusThreatDate Added
hxxp://39.78.26.151:57370/bin.shonlinemalware_download2026-08-17
hxxp://115.56.66.143:59123/bin.shonlinemalware_download2026-08-17
hxxp://222.140.159.233:46480/bin.shonlinemalware_download2026-08-17
hxxp://182.121.66.162:41960/ionlinemalware_download2026-08-17
hxxp://121.231.77.43:2715/ionlinemalware_download2026-08-17
hxxp://125.42.255.46:55570/bin.shonlinemalware_download2026-08-17
hxxp://123.9.41.95:38149/ionlinemalware_download2026-08-17
hxxp://115.48.146.252:57987/bin.shonlinemalware_download2026-08-17
hxxp://61.53.110.220:49686/bin.shonlinemalware_download2026-08-17
hxxp://125.44.53.155:43350/ionlinemalware_download2026-08-17
hxxp://123.11.204.30:46437/ionlinemalware_download2026-08-17
hxxp://61.52.159.43:42655/ionlinemalware_download2026-08-17
hxxp://46.236.65.163:51558/bin.shonlinemalware_download2026-08-17
hxxp://123.13.80.50:56227/bin.shonlinemalware_download2026-08-17
hxxp://182.118.241.162:42966/ionlinemalware_download2026-08-17
hxxp://61.53.110.220:49686/ionlinemalware_download2026-08-17
hxxp://61.53.74.117:55662/ionlinemalware_download2026-08-17
hxxp://219.156.20.248:59087/ionlinemalware_download2026-08-17
hxxp://182.118.246.94:39103/bin.shonlinemalware_download2026-08-17
hxxp://123.11.78.154:48079/ionlinemalware_download2026-08-17
hxxp://123.13.80.50:56227/ionlinemalware_download2026-08-17
hxxp://115.57.30.45:34814/ionlinemalware_download2026-08-17
hxxp://115.63.145.245:55982/ionlinemalware_download2026-08-17
hxxp://125.41.227.14:47543/ionlinemalware_download2026-08-17
hxxp://182.121.244.13:44914/ionlinemalware_download2026-08-17

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["39.78.26.151", "182.116.34.137", "219.157.34.223", "115.63.145.245", "123.9.41.95", "182.118.246.94", "125.41.227.14", "182.121.244.13", "46.236.65.163", "61.52.159.43", "125.42.255.46", "182.121.66.162", "61.53.119.47", "115.48.146.252", "115.57.30.45", "125.44.53.155", "61.53.110.220", "182.118.241.162", "61.53.74.117", "123.13.80.50", "115.56.66.143", "123.11.78.154", "123.11.204.30", "121.231.77.43", "222.140.159.233", "110.38.207.151", "219.156.20.248"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["39.78.26.151", "182.116.34.137", "219.157.34.223", "115.63.145.245", "123.9.41.95", "182.118.246.94", "125.41.227.14", "182.121.244.13", "46.236.65.163", "61.52.159.43", "125.42.255.46", "182.121.66.162", "61.53.119.47", "115.48.146.252", "115.57.30.45", "125.44.53.155", "61.53.110.220", "182.118.241.162", "61.53.74.117", "123.13.80.50", "115.56.66.143", "123.11.78.154", "123.11.204.30", "121.231.77.43", "222.140.159.233", "110.38.207.151", "219.156.20.248"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, along with targeted filters and exclusions:

Original source: https://urlhaus.abuse.ch/