← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-07-26T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving 32-bit specific malicious URLs that often target legacy systems or utilize architecture-specific exploits to establish initial access and command-and-control channels. A proactive hunt is essential in Azure Sentinel to uncover potential compromises on older endpoints that may lack modern protection, ensuring early identification of threats that could otherwise evade standard 64-bit focused monitoring.

IOC Summary

Threat: 32-bit Total URLs: 33 Active URLs: 31

URLStatusThreatDate Added
hxxp://117.26.226.163:59859/bin.shonlinemalware_download2026-07-26
hxxp://61.52.44.62:58722/bin.shonlinemalware_download2026-07-26
hxxp://125.166.31.187:48533/bin.shonlinemalware_download2026-07-26
hxxp://115.54.189.23:55481/ionlinemalware_download2026-07-26
hxxp://39.90.187.50:58528/bin.shonlinemalware_download2026-07-26
hxxp://115.54.189.23:55481/bin.shonlinemalware_download2026-07-26
hxxp://60.161.2.82:56389/ionlinemalware_download2026-07-26
hxxp://112.248.155.45:45383/ionlinemalware_download2026-07-26
hxxp://60.161.2.82:56389/bin.shonlinemalware_download2026-07-26
hxxp://216.126.86.127:58945/ionlinemalware_download2026-07-26
hxxp://221.15.189.92:53997/bin.shonlinemalware_download2026-07-26
hxxp://27.215.138.98:41527/ionlinemalware_download2026-07-26
hxxp://115.57.74.75:35953/ionlinemalware_download2026-07-26
hxxp://115.57.74.75:35953/bin.shonlinemalware_download2026-07-26
hxxp://222.134.175.71:46678/ionlinemalware_download2026-07-26
hxxp://222.134.175.71:46678/bin.shonlinemalware_download2026-07-26
hxxp://123.14.102.112:54726/bin.shonlinemalware_download2026-07-26
hxxp://115.50.66.149:51699/ionlinemalware_download2026-07-26
hxxp://219.156.105.152:51559/ionlinemalware_download2026-07-26
hxxp://42.178.61.155:32836/ionlinemalware_download2026-07-26
hxxp://115.50.66.149:51699/bin.shonlinemalware_download2026-07-26
hxxp://42.231.47.59:38421/ionlinemalware_download2026-07-26
hxxp://196.189.198.193:41438/iofflinemalware_download2026-07-26
hxxp://196.189.198.193:41438/bin.shonlinemalware_download2026-07-26
hxxp://196.191.137.44:58420/bin.shonlinemalware_download2026-07-26

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["39.90.187.50", "115.50.66.149", "125.166.31.187", "42.7.240.14", "61.52.44.62", "216.126.86.127", "123.14.102.112", "196.189.198.193", "42.231.47.59", "42.178.61.155", "27.37.102.120", "60.161.2.82", "115.54.189.23", "27.215.138.98", "196.191.104.40", "117.26.226.163", "221.15.189.92", "115.57.74.75", "112.248.155.45", "105.184.26.87", "196.191.137.44", "219.156.105.152", "222.134.175.71"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["39.90.187.50", "115.50.66.149", "125.166.31.187", "42.7.240.14", "61.52.44.62", "216.126.86.127", "123.14.102.112", "196.189.198.193", "42.231.47.59", "42.178.61.155", "27.37.102.120", "60.161.2.82", "115.54.189.23", "27.215.138.98", "196.191.104.40", "117.26.226.163", "221.15.189.92", "115.57.74.75", "112.248.155.45", "105.184.26.87", "196.191.137.44", "219.156.105.152", "222.134.175.71"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

False Positive Scenarios for “URLhaus: 32-bit Malicious URLs” Rule

Original source: https://urlhaus.abuse.ch/