URLhaus: 198-251-91-148-8080 Malicious URLs

Hunt Hypothesis

This hypothesis targets potential web-based intrusion attempts by identifying traffic to a known malicious URL cluster associated with the IP 198.251.91.148 on port 8080, which often serves as a staging point for initial access or command-and-control communications. Proactively hunting for these specific URLs in Azure Sentinel allows the SOC team to detect compromised endpoints or phishing campaigns before they escalate into full-scale breaches or lateral movement within the environment.

IOC Summary

Threat: 198-251-91-148-8080 Total URLs: 11 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 198-251-91-148-8080
let malicious_domains = dynamic(["198.251.91.148"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["198.251.91.148"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A legacy internal API gateway or load balancer (e.g., F5 BIG-IP or Nginx) is configured to proxy traffic to an upstream service hosted on 198.251.91.148:8080 for backward compatibility or a specific microservice dependency.

  • Filter/Exclusion: Exclude alerts where the source IP belongs to the internal API Gateway subnet (e.g., 10.20.5.0/24) and the destination port is 8080, specifically if the user agent string matches the internal service identifier (e.g., internal-api-gateway/1.0).

• Scenario: A scheduled PowerShell script executed by a service account (e.g., svc-backup) performs a health check or data sync by making an HTTP GET request to http://198.251.91.148:8080/health to verify the status of a third-party SaaS integration or a specific cloud storage endpoint.

  • Filter/Exclusion: Exclude alerts where the process name is powershell.exe or pwsh.exe, the parent process is svchost.exe or taskeng.exe, and the command line contains the string /health or /status alongside the target URL.

• Scenario: A developer or QA engineer uses a local proxy tool like Charles Proxy or Fiddler on a workstation to intercept and inspect traffic for a web application that is configured to send analytics or telemetry data to 198.251.91.148:8080 during a staging environment test.

  • Filter/Exclusion: Exclude alerts originating from workstations in the DEV-WS or QA-WS VLAN where the source