URLhaus: 165-232-55-140 Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging known malicious infrastructure at IP 165.232.55.140 to deliver payloads via compromised URLs, as identified by URLhaus threat intelligence. Proactively hunting for this behavior in Azure Sentinel is critical to validate the scope of potential infections and ensure that existing network policies effectively block traffic from this high-severity source before it impacts broader organizational assets.

IOC Summary

Threat: 165-232-55-140 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 165-232-55-140
let malicious_domains = dynamic(["165.232.55.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["165.232.55.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: 165-232-55-140 Malicious URLs detection rule in an enterprise environment, along with recommended filters and exclusions.

• Automated Patch Management Scans by WSUS/SCCM

  • Scenario: The Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager (MECM/SCCM) servers periodically contact the IP 165-232-55-140 to download metadata, patch manifests, or verify repository integrity. This traffic often originates from the central management server rather than end-user workstations and is a routine administrative task.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts where the Source IP belongs to the internal “Patch Management” subnet (e.g., 10.20.50.0/24) AND the Destination URL contains keywords like /update, /manifest, or /repository. Alternatively, whitelist the specific source server’s hostname in the SIEM correlation rule.

• Third-Party Cloud Backup Agent Heartbeats

  • Scenario: Enterprise backup agents (such as Veeam Backup & Replication or Commvault) running on file servers initiate scheduled connection checks to 165-232-55-140. This IP may host a cloud storage gateway or an API endpoint used for off-site verification. The traffic is generated by the vbrsvc (Veeam) or commserver service during nightly backup windows, not user browsing activity.
  • Filter/Exclusion: Filter out events where the Process Name matches known backup services (e.g., vbrservice.exe, cvsserver.exe) AND the Event Time falls within the defined maintenance window (e