This hunt detects adversary behavior involving connections to a specific set of 20 malicious URLs identified by URLhaus under IP 176.65.139.195, which are likely associated with active phishing campaigns or command-and-control infrastructure. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate compromised endpoints before they facilitate data exfiltration or lateral movement within the network.
Threat: 176-65-139-195 Total URLs: 20 Active URLs: 18
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://176.65.139.195/proot | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/syst3md | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/wd1337 | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/traffaarch | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/log | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/oldercheck.sh | offline | malware_download | 2026-08-11 |
hxxp://176.65.139.195/traff | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/cli | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/Error84 | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/oldboss | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/main | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/cliaarch | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/check.sh | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/checkmacos.sh | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/boss | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/check1.sh | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/nvidia.sh | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/auto1 | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/auto | online | malware_download | 2026-08-11 |
hxxp://176.65.139.195/loli | offline | malware_download | 2026-08-11 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-195
let malicious_domains = dynamic(["176.65.139.195"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.195"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding exclusions for the URLhaus: 176-65-139-195 Malicious URLs detection rule:
Scenario: The enterprise’s endpoint management suite (e.g., Microsoft Intune or SCCM) initiates a scheduled daily “Definition Update” job where the client pulls the latest threat intelligence feed from http://176.65.139.195/api/v1/updates. This legitimate traffic is misidentified as malicious because the IP belongs to a known third-party security vendor hosting a public API.
/api/v1/updates when accessed by service accounts or system processes (e.g., Microsoft.Windows.Client.Service.exe) during business hours (08:00–20:00).Scenario: The IT Operations team utilizes a legacy backup automation script that connects to an external cloud storage gateway hosted at the IP 176.65.139.195 to verify integrity checksums for critical database dumps every Sunday at 02:00 AM. The detection logic flags this periodic connection as suspicious due to the “Malicious” tag associated with that specific URL in the Hunt package, despite the gateway being a trusted partner.
BackupService_01) to the domain or IP 176.65.139.195 specifically between Sunday 01:00 and 04:00.Scenario: A third-party SaaS application used for HR analytics (e.g., Workday or a custom dashboard) embeds a widget that fetches real-time market data from the URL `