URLhaus: 176-65-139-208 Malicious URLs

Hunt Hypothesis

This hypothesis targets potential web-based intrusion attempts or phishing campaigns leveraging the malicious IP 176.65.139.208, which may be used to host landing pages or deliver payloads to compromised endpoints. Proactively hunting for these specific URLs in Azure Sentinel allows the SOC to identify early-stage lateral movement or credential harvesting activities before they escalate into a full breach.

IOC Summary

Threat: 176-65-139-208 Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-208
let malicious_domains = dynamic(["176.65.139.208"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.208"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: Older internal web applications or legacy middleware (e.g., Apache Tomcat, IIS) may have hardcoded health check endpoints or diagnostic scripts that periodically ping external IP 176.65.139.208 to verify network egress or retrieve version metadata.
  • Filter/Exclusion: Exclude network connections where the source process is a known application server binary (e.g., java.exe, w3wp.exe, httpd.exe) and the destination port is 80 or 443, specifically if the URL path matches known diagnostic paths like /health, /status, or /version.
• Scheduled Backup Verification Jobs: Enterprise backup solutions (e.g., Veeam, Commvault, or custom PowerShell scripts) often include a “connectivity test” step in their scheduled jobs to ensure the backup repository or cloud endpoint is reachable before initiating data transfer. If the backup target or a verification endpoint resolves to this IP, it will trigger the rule.
  • Filter/Exclusion: Exclude connections initiated by backup service executables (e.g., VeeamBackup.exe, commvault.exe, powershell.exe running from the backup agent directory) where the destination IP matches 176.65.139.208 and the source port is ephemeral, provided the job is scheduled during known maintenance windows.
• CI/CD Pipeline Artifact Fetching: Continuous Integration/Continuous Deployment (CI/CD) agents (e.g., Jenkins, GitLab Runner, Azure DevOps Agent) may fetch build artifacts, container images, or dependency packages from a private registry or artifact repository that happens to be hosted on or proxied through 176.65.139.208.
  • Filter/Exclusion: Exclude connections from CI/CD