← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-07-30T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection rule identifies adversary activity involving known malicious URLs specifically targeting 32-bit architectures, which often indicates an attempt to exploit legacy systems or bypass modern security controls that prioritize 64-bit environments. Proactively hunting for these indicators in Azure Sentinel is critical because 32-bit endpoints frequently represent a high-risk attack surface with fewer native protections, making them prime targets for initial compromise and lateral movement.

IOC Summary

Threat: 32-bit Total URLs: 35 Active URLs: 31

URLStatusThreatDate Added
hxxp://105.186.64.236:52293/bin.shonlinemalware_download2026-07-30
hxxp://219.157.11.85:45654/bin.shonlinemalware_download2026-07-30
hxxp://123.9.220.15:51815/ionlinemalware_download2026-07-30
hxxp://115.48.48.140:59805/ionlinemalware_download2026-07-30
hxxp://115.48.48.140:59805/bin.shonlinemalware_download2026-07-30
hxxp://125.40.131.1:52924/ionlinemalware_download2026-07-30
hxxp://113.230.197.154:40757/bin.shonlinemalware_download2026-07-30
hxxp://123.9.220.15:51815/bin.shonlinemalware_download2026-07-30
hxxp://222.142.250.233:37018/ionlinemalware_download2026-07-30
hxxp://115.49.202.106:57597/ionlinemalware_download2026-07-30
hxxp://125.40.131.1:52924/bin.shonlinemalware_download2026-07-30
hxxp://39.81.22.56:45205/ionlinemalware_download2026-07-30
hxxp://182.119.60.180:48123/ionlinemalware_download2026-07-30
hxxp://221.15.6.71:56873/ionlinemalware_download2026-07-30
hxxp://182.119.60.180:48123/bin.shonlinemalware_download2026-07-30
hxxp://221.15.6.71:56873/bin.shonlinemalware_download2026-07-30
hxxp://182.123.178.196:50097/ionlinemalware_download2026-07-30
hxxp://123.4.238.131:57813/ionlinemalware_download2026-07-30
hxxp://221.15.4.12:49038/ionlinemalware_download2026-07-30
hxxp://182.123.178.196:50097/bin.shonlinemalware_download2026-07-30
hxxp://196.190.69.149:54241/ionlinemalware_download2026-07-30
hxxp://103.157.210.26:36636/ionlinemalware_download2026-07-30
hxxp://123.9.199.52:50973/ionlinemalware_download2026-07-30
hxxp://221.15.4.12:49038/bin.shonlinemalware_download2026-07-30
hxxp://164.163.25.149:53018/ionlinemalware_download2026-07-30

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["115.48.48.140", "182.119.60.180", "125.40.131.1", "105.186.64.236", "123.4.238.131", "115.55.234.204", "110.137.153.25", "123.9.220.15", "164.163.25.149", "103.157.210.26", "221.15.4.12", "196.190.69.149", "219.156.60.143", "182.123.178.196", "123.9.199.52", "113.230.197.154", "39.81.22.56", "219.157.11.85", "222.142.250.233", "221.15.6.71", "115.49.202.106"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.48.48.140", "182.119.60.180", "125.40.131.1", "105.186.64.236", "123.4.238.131", "115.55.234.204", "110.137.153.25", "123.9.220.15", "164.163.25.149", "103.157.210.26", "221.15.4.12", "196.190.69.149", "219.156.60.143", "182.123.178.196", "123.9.199.52", "113.230.197.154", "39.81.22.56", "219.157.11.85", "222.142.250.233", "221.15.6.71", "115.49.202.106"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://urlhaus.abuse.ch/