← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-07-31T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects adversaries leveraging known 32-bit malicious URLs to deliver payloads or establish command-and-control channels within the network. A SOC team should proactively search for these indicators in Azure Sentinel to identify early-stage compromise attempts that may evade standard perimeter defenses and prevent lateral movement by malicious actors.

IOC Summary

Threat: 32-bit Total URLs: 74 Active URLs: 66

URLStatusThreatDate Added
hxxp://115.56.174.240:39335/ionlinemalware_download2026-07-31
hxxp://59.97.249.167:40316/bin.shonlinemalware_download2026-07-31
hxxp://125.47.74.250:45378/ionlinemalware_download2026-07-31
hxxp://175.31.188.203:48322/ionlinemalware_download2026-07-31
hxxp://221.15.187.214:51317/ionlinemalware_download2026-07-31
hxxp://182.121.244.248:50229/ionlinemalware_download2026-07-31
hxxp://182.121.244.248:50229/bin.shonlinemalware_download2026-07-31
hxxp://125.47.74.250:45378/bin.shonlinemalware_download2026-07-31
hxxp://42.228.91.217:42496/ionlinemalware_download2026-07-31
hxxp://222.137.25.247:54698/ionlinemalware_download2026-07-31
hxxp://182.117.152.80:55723/ionlinemalware_download2026-07-31
hxxp://115.50.229.76:46799/ionlinemalware_download2026-07-31
hxxp://125.43.38.166:59865/ionlinemalware_download2026-07-31
hxxp://42.228.91.217:42496/bin.shonlinemalware_download2026-07-31
hxxp://61.53.135.228:56936/ionlinemalware_download2026-07-31
hxxp://196.189.9.233:42853/bin.shonlinemalware_download2026-07-31
hxxp://105.224.72.150:33723/ionlinemalware_download2026-07-31
hxxp://115.50.229.76:46799/bin.shonlinemalware_download2026-07-31
hxxp://182.117.152.80:55723/bin.shonlinemalware_download2026-07-31
hxxp://125.160.208.110:57888/ionlinemalware_download2026-07-31
hxxp://61.53.135.228:56936/bin.shonlinemalware_download2026-07-31
hxxp://39.74.61.72:46007/bin.shonlinemalware_download2026-07-31
hxxp://182.113.252.127:47336/ionlinemalware_download2026-07-31
hxxp://125.160.208.110:57888/bin.shonlinemalware_download2026-07-31
hxxp://177.39.122.214:53607/ionlinemalware_download2026-07-31

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["125.43.38.166", "42.57.20.156", "61.53.135.228", "59.97.249.167", "115.56.174.240", "222.137.25.247", "177.39.122.214", "221.15.187.214", "182.117.152.80", "196.189.9.233", "182.113.252.127", "125.160.208.110", "42.228.91.217", "125.47.74.250", "115.55.198.142", "115.61.115.0", "105.224.72.150", "39.74.61.72", "175.31.188.203", "115.50.229.76", "83.219.1.198", "182.121.244.248"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["125.43.38.166", "42.57.20.156", "61.53.135.228", "59.97.249.167", "115.56.174.240", "222.137.25.247", "177.39.122.214", "221.15.187.214", "182.117.152.80", "196.189.9.233", "182.113.252.127", "125.160.208.110", "42.228.91.217", "125.47.74.250", "115.55.198.142", "115.61.115.0", "105.224.72.150", "39.74.61.72", "175.31.188.203", "115.50.229.76", "83.219.1.198", "182.121.244.248"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://urlhaus.abuse.ch/