← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-06-22T11:00:00Z · Confidence: medium

Hunt Hypothesis

The detection identifies potential 32-bit malware distribution through malicious URLs, which adversaries may use to deliver payloads in environments where 32-bit systems or applications are still in use. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage compromise attempts targeting legacy or mixed architecture environments.

IOC Summary

Threat: 32-bit Total URLs: 20 Active URLs: 20

URLStatusThreatDate Added
hxxp://123.5.125.175:48308/ionlinemalware_download2026-06-22
hxxp://219.157.143.44:33777/ionlinemalware_download2026-06-22
hxxp://196.189.3.1:54492/bin.shonlinemalware_download2026-06-22
hxxp://202.107.5.69:38499/ionlinemalware_download2026-06-22
hxxp://115.48.151.124:47369/bin.shonlinemalware_download2026-06-22
hxxp://61.53.80.233:54338/ionlinemalware_download2026-06-22
hxxp://61.53.80.233:54338/bin.shonlinemalware_download2026-06-22
hxxp://123.5.125.175:48308/bin.shonlinemalware_download2026-06-22
hxxp://42.177.28.175:47234/ionlinemalware_download2026-06-22
hxxp://202.107.5.69:38499/bin.shonlinemalware_download2026-06-22
hxxp://219.157.143.44:33777/bin.shonlinemalware_download2026-06-22
hxxp://42.224.74.89:52676/ionlinemalware_download2026-06-22
hxxp://118.232.137.101:51907/ionlinemalware_download2026-06-22
hxxp://112.242.55.227:43000/ionlinemalware_download2026-06-22
hxxp://125.160.141.80:52651/bin.shonlinemalware_download2026-06-22
hxxp://182.127.36.64:43772/ionlinemalware_download2026-06-22
hxxp://115.55.54.56:49032/ionlinemalware_download2026-06-22
hxxp://119.179.215.65:48587/ionlinemalware_download2026-06-22
hxxp://119.179.215.65:48587/bin.shonlinemalware_download2026-06-22
hxxp://182.117.55.224:41017/ionlinemalware_download2026-06-22

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["219.157.143.44", "112.242.55.227", "123.5.125.175", "42.224.74.89", "182.127.36.64", "115.55.54.56", "119.179.215.65", "182.117.55.224", "115.48.151.124", "196.189.3.1", "118.232.137.101", "125.160.141.80", "42.177.28.175", "202.107.5.69", "61.53.80.233"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["219.157.143.44", "112.242.55.227", "123.5.125.175", "42.224.74.89", "182.127.36.64", "115.55.54.56", "119.179.215.65", "182.117.55.224", "115.48.151.124", "196.189.3.1", "118.232.137.101", "125.160.141.80", "42.177.28.175", "202.107.5.69", "61.53.80.233"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/