URLhaus: 176-65-139-237 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving traffic to a specific set of 14 malicious URLs associated with the IP address 176-65-139-237, which are known indicators of compromise for web-based threats. A SOC team should proactively hunt for these URLs in Azure Sentinel to identify potential early-stage infections or data exfiltration attempts that may have bypassed standard perimeter defenses due to the high severity and targeted nature of this threat intelligence feed.

IOC Summary

Threat: 176-65-139-237 Total URLs: 14 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-237
let malicious_domains = dynamic(["176.65.139.237"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.237"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: 176-65-139-237 Malicious URLs detection rule, including tailored filters and exclusions:

• Scheduled Security Scanner Traffic

  • Scenario: The enterprise’s internal vulnerability scanner (e.g., Tenable Nessus or Qualys) performs nightly health checks by probing external security feeds. If the IP 176.65.139.237 is part of a known trusted feed list used by the scanner, it will generate traffic that mimics malicious URL access.
  • Filter/Exclusion: Create an exclusion rule in the SIEM to suppress alerts where the source host belongs to the VULN-SCANNER-SG security group and the destination port is restricted to standard HTTP/HTTPS (80/443). Alternatively, add 176.65.139.237 to the global “Trusted External IPs” allowlist if confirmed as a benign feed provider.

• Cloud Backup and Synchronization Jobs

  • Scenario: Automated backup agents (e.g., Veeam, Rubrik, or Microsoft Azure Backup) running on file servers initiate connections to cloud storage endpoints for metadata synchronization. If the IP 176.65.139.237 represents a specific CDN node or API gateway used by these backup services, routine sync jobs will trigger the rule.
  • Filter/Exclusion: Implement a filter that excludes traffic originating from hosts tagged with the BACKUP-AGENT label during the defined maintenance window (e.g., 02:00 – 04:00 UTC). Additionally, exclude URLs containing specific backup service paths (e.g., /api/v1/sync)