This hypothesis targets adversaries leveraging the specific IP address 45.148.10.165 on port 8000 to host malicious payloads or serve phishing content, a pattern frequently observed in recent threat campaigns. Proactively hunting for these URLs in Azure Sentinel allows the SOC to identify compromised endpoints or web traffic anomalies before they progress to full compromise, ensuring rapid containment of high-severity threats.
Threat: 45-148-10-165-8000 Total URLs: 3 Active URLs: 3
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://45.148.10.165:8000/beacon_linux_amd64_p_7b574e59d96d49 | online | malware_download | 2026-09-25 |
hxxp://45.148.10.165:8000/beacon_linux_amd64_p_dda99b0936c24b | online | malware_download | 2026-09-25 |
hxxp://45.148.10.165:8000/beacon_windows_amd64_p_f916b8b840004d.exe | online | malware_download | 2026-09-25 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 45-148-10-165-8000
let malicious_domains = dynamic(["45.148.10.165"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.148.10.165"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
45-148-10-165-8000 as a hardcoded backend dependency for health checks or data synchronization. This is common in environments where IP-based routing was used before DNS migration.
app.exe, java.exe, node.exe) and the destination port is 8000, specifically if the source IP belongs to the application server subnet.45-148-10-165-8000. This often happens when backup tools are configured to use direct IP addresses instead of hostnames for performance reasons.
vssadmin.exe, wbadmin.exe, backup-agent.exe) or a scripting engine (powershell.exe, python.exe) initiating an outbound connection to port 8000 during defined maintenance windows.curl, Postman, or JMeter against the staging instance hosted at 45-148-10-165-8000. This is frequent in dev environments where DNS entries for staging services are not always propagated to all workstations.