← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-05T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection rule identifies adversary activity involving the execution or access of known 32-bit malicious URLs, which often serve as initial entry points for targeted attacks on legacy systems. A proactive hunt in Azure Sentinel is essential to uncover potential lateral movement or data exfiltration attempts that may bypass standard perimeter defenses by leveraging these specific 32-bit indicators.

IOC Summary

Threat: 32-bit Total URLs: 26 Active URLs: 26

URLStatusThreatDate Added
hxxp://115.49.240.130:34325/bin.shonlinemalware_download2026-08-05
hxxp://115.55.115.96:44003/ionlinemalware_download2026-08-05
hxxp://182.113.250.40:55617/ionlinemalware_download2026-08-05
hxxp://222.141.74.228:46205/ionlinemalware_download2026-08-05
hxxp://115.51.95.76:57996/bin.shonlinemalware_download2026-08-05
hxxp://123.5.126.137:60939/ionlinemalware_download2026-08-05
hxxp://125.44.60.121:45542/ionlinemalware_download2026-08-05
hxxp://123.5.126.137:60939/bin.shonlinemalware_download2026-08-05
hxxp://115.49.131.148:60155/bin.shonlinemalware_download2026-08-05
hxxp://125.44.60.121:45542/bin.shonlinemalware_download2026-08-05
hxxp://101.109.170.235:45360/ionlinemalware_download2026-08-05
hxxp://175.9.132.112:50484/ionlinemalware_download2026-08-05
hxxp://182.119.57.28:48123/ionlinemalware_download2026-08-05
hxxp://182.119.34.47:58607/ionlinemalware_download2026-08-05
hxxp://42.85.239.3:46645/ionlinemalware_download2026-08-05
hxxp://175.9.132.112:50484/bin.shonlinemalware_download2026-08-05
hxxp://101.109.170.235:45360/bin.shonlinemalware_download2026-08-05
hxxp://182.119.34.47:58607/bin.shonlinemalware_download2026-08-05
hxxp://182.119.57.28:48123/bin.shonlinemalware_download2026-08-05
hxxp://119.179.214.25:35406/ionlinemalware_download2026-08-05
hxxp://120.84.213.43:39139/ionlinemalware_download2026-08-05
hxxp://42.230.71.230:39489/ionlinemalware_download2026-08-05
hxxp://182.121.181.242:39984/ionlinemalware_download2026-08-05
hxxp://42.230.71.230:39489/bin.shonlinemalware_download2026-08-05
hxxp://42.86.120.110:36469/ionlinemalware_download2026-08-05

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["175.9.132.112", "182.121.181.242", "115.49.131.148", "182.119.57.28", "182.113.250.40", "182.119.34.47", "115.49.240.130", "123.5.126.137", "101.109.170.235", "42.85.239.3", "222.141.74.228", "120.84.213.43", "115.55.115.96", "42.86.120.110", "115.51.95.76", "125.44.60.121", "119.179.214.25", "42.230.71.230"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["175.9.132.112", "182.121.181.242", "115.49.131.148", "182.119.57.28", "182.113.250.40", "182.119.34.47", "115.49.240.130", "123.5.126.137", "101.109.170.235", "42.85.239.3", "222.141.74.228", "120.84.213.43", "115.55.115.96", "42.86.120.110", "115.51.95.76", "125.44.60.121", "119.179.214.25", "42.230.71.230"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

False Positive Scenarios for “URLhaus: 32-bit Malicious URLs” Rule

Original source: https://urlhaus.abuse.ch/