URLhaus: 196-251-121-185 Malicious URLs

Hunt Hypothesis

This rule detects the presence of specific malicious URLs associated with the IP address 196.251.121.185, indicating potential web-based attack vectors or compromised endpoints communicating with known threat infrastructure. Proactively hunting for these URLs in Azure Sentinel allows the SOC team to identify early-stage compromise or lateral movement attempts before they escalate into a full-blown incident.

IOC Summary

Threat: 196-251-121-185 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 196-251-121-185
let malicious_domains = dynamic(["196.251.121.185"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["196.251.121.185"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A legacy internal API gateway or service mesh (e.g., Istio, Linkerd, or a custom Java/.NET microservice) is configured with a hardcoded fallback endpoint or health check URL that points to 196.251.121.185 for load balancing or failover purposes, triggering the rule during routine traffic inspection.

  • Filter/Exclusion: Exclude alerts where the source IP belongs to the specific application server cluster (e.g., app-prod-cluster-01) AND the destination port is 443 or 80 AND the User-Agent string matches the internal service identifier (e.g., internal-api-gateway/1.2).

• Scenario: A scheduled PowerShell or Bash script executed by a CI/CD pipeline (e.g., Jenkins, GitLab CI, or Azure DevOps) uses curl or wget to fetch build artifacts, configuration files, or dependency manifests from a temporary staging server hosted at 196.251.121.185 before promoting them to the production registry.

  • Filter/Exclusion: Exclude alerts where the process name is powershell.exe or bash AND the parent process is a known CI/CD agent (e.g., jenkins-agent, gitlab-runner) AND the command line contains keywords like fetch, download, or sync AND the execution time aligns with the scheduled build window.

• Scenario: A network monitoring tool (e.g., Nagios, Zabbix, or PRTG) performs active synthetic monitoring by periodically pinging or HTTP GET requests to 196.251.121.185 to verify upstream service availability, which is a legitimate operational task rather than an initial compromise vector.

  • **Filter/