URLhaus: 176-65-139-157 Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging the IP address 176.65.139.157 to host malicious URLs, a behavior often associated with phishing campaigns or command-and-control infrastructure. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious user activity before the malicious URLs are actively exploited for data exfiltration or payload delivery.

This hypothesis targets adversaries leveraging the IP address 176.65.139.157 to host malicious URLs, a behavior often associated with phishing campaigns or command-and-control infrastructure. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious user activity before the malicious URLs are actively exploited for data exfiltration or payload delivery.

IOC Summary

Threat: 176-65-139-157 Total URLs: 12 Active URLs: 11

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-157
let malicious_domains = dynamic(["176.65.139.157"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.157"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) configured with a hardcoded health-check endpoint that points to a staging or test environment hosted on the 176.65.139.157 IP range. This occurs when the application’s cron job or Windows Task Scheduler triggers a periodic HTTP GET request to verify service availability, inadvertently hitting a URL flagged by URLhaus due to a shared hosting provider or a compromised subdomain.

  • Filter/Exclusion: Exclude traffic from the specific service account used by the legacy app (e.g., svc-legacy-inventory) or filter by the specific User-Agent string if the legacy app sends a unique identifier (e.g., LegacyApp-HealthCheck/1.0).

• Third-Party SaaS Webhook Integration: A marketing automation platform (e.g., HubSpot or Marketo) configured to send webhook notifications to a customer-specific landing page or tracking pixel hosted on the 176.65.139.157 IP. This is a legitimate business process where the SaaS tool initiates an outbound HTTPS request to log user actions, but the URL is flagged because the hosting provider has been associated with other malicious campaigns.

  • Filter/Exclusion: Exclude outbound connections from the SaaS integration service account (e.g., svc-marketing-automation) or filter by the specific port (443) and the known CIDR range of the SaaS provider’s egress IPs if they differ from the malicious tag’s specific URL path.

• CI/CD Pipeline Artifact Download: A Jenkins or GitLab CI pipeline job that downloads a build artifact or dependency from a private artifact repository (e.g., Nexus or Artifactory) hosted on the 176.65.139.157 IP