URLhaus: 104-239-66-130 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving known malicious URLs from the URLhaus threat intelligence feed, specifically targeting indicators associated with the 104-239-66-130 signature to catch potential web-based threats like phishing or drive-by downloads. A proactive hunt is essential in Azure Sentinel to immediately isolate affected endpoints and prevent lateral movement before these high-severity URLs can compromise internal systems through user interaction or automated browser traffic.

IOC Summary

Threat: 104-239-66-130 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 104-239-66-130
let malicious_domains = dynamic(["104.239.66.130"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["104.239.66.130"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 104-239-66-130 Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Cloud Backup and Synchronization Agents

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Microsoft OneDrive for Business frequently connect to the IP 104.239.66.130 (often associated with Google’s infrastructure or specific CDN nodes) to perform scheduled delta scans, metadata synchronization, and file uploads during off-hours.
  • Suggested Filter: Create an exclusion rule that filters out traffic originating from known backup service accounts (e.g., svc-backup-veeam) connecting specifically to the destination IP 104.239.66.130 on standard HTTPS ports (443) during defined maintenance windows (e.g., 02:00–05:00 UTC).

• Scenario: Enterprise Software Update Mechanisms

  • Context: Critical productivity suites such as Microsoft Office 365, Adobe Creative Cloud, or Zoom utilize this IP for their global content delivery network (CDN) to push hotfixes, license validation tokens, and feature updates. These connections are often initiated by the local update service rather than user browsing activity.
  • Suggested Filter: Implement a whitelist exclusion based on the executable hash of the update agents (e.g., Microsoft.Update.Service.exe or AdobeUpdateService.exe) when they initiate outbound HTTPS sessions to 104.239.66.130.

• Scenario: Scheduled Third-Party SIEM/EDR Data Ingestion

  • Context: Security