← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-11T23:00:01Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary behavior involving the execution of 32-bit malware payloads delivered through known malicious URLs, which often target legacy systems or specific browser configurations. A SOC team should proactively hunt for these indicators in Azure Sentinel to uncover potential lateral movement or initial access attempts that may evade standard 64-bit focused defenses.

IOC Summary

Threat: 32-bit Total URLs: 41 Active URLs: 40

URLStatusThreatDate Added
hxxp://115.50.150.5:40794/bin.shonlinemalware_download2026-08-11
hxxp://221.15.141.166:50250/ionlinemalware_download2026-08-11
hxxp://123.4.178.145:35087/bin.shonlinemalware_download2026-08-11
hxxp://182.121.138.136:38226/ionlinemalware_download2026-08-11
hxxp://221.15.141.166:50250/bin.shonlinemalware_download2026-08-11
hxxp://42.224.175.231:41660/bin.shonlinemalware_download2026-08-11
hxxp://182.121.138.136:38226/bin.shonlinemalware_download2026-08-11
hxxp://163.142.93.187:39139/ionlinemalware_download2026-08-11
hxxp://175.175.7.234:37031/ionlinemalware_download2026-08-11
hxxp://175.148.158.154:36869/ionlinemalware_download2026-08-11
hxxp://163.142.93.187:39139/bin.shonlinemalware_download2026-08-11
hxxp://112.251.225.122:36907/ionlinemalware_download2026-08-11
hxxp://125.45.148.93:57695/bin.shonlinemalware_download2026-08-11
hxxp://175.148.158.154:36869/bin.shonlinemalware_download2026-08-11
hxxp://222.142.245.198:49568/ionlinemalware_download2026-08-11
hxxp://59.91.206.69:41124/bin.shonlinemalware_download2026-08-11
hxxp://222.142.245.198:49568/bin.shonlinemalware_download2026-08-11
hxxp://190.109.228.150:37896/ionlinemalware_download2026-08-11
hxxp://190.109.228.150:37896/bin.shonlinemalware_download2026-08-11
hxxp://182.117.165.9:33305/iofflinemalware_download2026-08-11
hxxp://42.227.207.180:58373/ionlinemalware_download2026-08-11
hxxp://42.227.207.180:58373/bin.shonlinemalware_download2026-08-11
hxxp://175.173.53.215:46519/ionlinemalware_download2026-08-11
hxxp://123.8.45.230:53516/ionlinemalware_download2026-08-11
hxxp://78.25.123.5:48319/ionlinemalware_download2026-08-11

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["42.224.175.231", "59.91.206.69", "125.45.148.93", "120.84.214.53", "163.142.93.187", "190.109.228.150", "175.148.158.154", "175.173.53.215", "112.251.225.122", "221.15.141.166", "175.175.7.234", "123.8.45.230", "42.227.207.180", "115.50.150.5", "125.41.228.207", "78.25.123.5", "219.155.236.173", "222.142.245.198", "182.121.138.136", "123.4.178.145"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.224.175.231", "59.91.206.69", "125.45.148.93", "120.84.214.53", "163.142.93.187", "190.109.228.150", "175.148.158.154", "175.173.53.215", "112.251.225.122", "221.15.141.166", "175.175.7.234", "123.8.45.230", "42.227.207.180", "115.50.150.5", "125.41.228.207", "78.25.123.5", "219.155.236.173", "222.142.245.198", "182.121.138.136", "123.4.178.145"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/