URLhaus: 176-65-134-121-8080 Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging the specific IP address 176.65.134.121 on port 8080 to host malicious content, a pattern frequently associated with phishing campaigns or command-and-control infrastructure. Proactively hunting for these URLs in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious web traffic before the malicious payload is fully executed or data is exfiltrated.

IOC Summary

Threat: 176-65-134-121-8080 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-134-121-8080
let malicious_domains = dynamic(["176.65.134.121"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.134.121"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A legacy internal web application or API gateway hosted on the IP 176.65.134.121 uses port 8080 for its management console or health check endpoints, which is accessed by automated monitoring agents (e.g., Datadog, New Relic, or custom Python scripts running via cron/Task Scheduler).

  • Filter/Exclusion: Exclude source processes that are known monitoring agents (e.g., agent.exe, python.exe, node.exe) when the destination URL matches http://176.65.134.121:8080/* and the source user account belongs to the MonitoringService or AppAdmin group.

• Scenario: A developer or DevOps engineer is manually testing a staging environment or a specific microservice deployed on that IP using a browser or HTTP client (e.g., curl, Postman, or PowerShell Invoke-WebRequest) during a scheduled deployment verification job.

  • Filter/Exclusion: Exclude events where the source process is a standard HTTP client (curl.exe, powershell.exe, postman.exe) and the user account is part of the DevOps or QA security group, provided the connection occurs during business hours or within a defined maintenance window.

• Scenario: A containerized application (e.g., running in Kubernetes or Docker) has a hardcoded configuration pointing to 176.65.134.121:8080 for an external dependency or a shared service registry, causing frequent legitimate outbound connections from container runtime processes.

  • Filter/Exclusion: Exclude connections originating from container runtime processes (e.g., containerd-shim, dockerd, or specific container image names) where the