← Back to SOC feed Coverage →

URLhaus: censys Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-07-28T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving traffic to a curated set of 42 Censys-tagged malicious URLs that are known indicators of compromise. Proactive hunting in Azure Sentinel is essential because these high-severity signals often represent early-stage reconnaissance or command-and-control channels that may not yet trigger standard alerting thresholds, allowing the SOC team to intercept threats before lateral movement occurs.

IOC Summary

Threat: censys Total URLs: 42 Active URLs: 38

URLStatusThreatDate Added
hxxp://120.46.15.254/pty10onlinemalware_download2026-07-28
hxxp://34.88.165.144:8080/pty3onlinemalware_download2026-07-28
hxxp://159.112.183.71:8080/pty10offlinemalware_download2026-07-28
hxxp://113.45.17.8/pty3onlinemalware_download2026-07-28
hxxp://116.205.168.247/pty4onlinemalware_download2026-07-28
hxxp://1.95.51.146/pty4onlinemalware_download2026-07-28
hxxp://114.132.77.127:8080/pty3onlinemalware_download2026-07-28
hxxp://113.45.17.8/pty4onlinemalware_download2026-07-28
hxxp://1.94.221.183/pty4onlinemalware_download2026-07-28
hxxp://1.94.221.183/pty3onlinemalware_download2026-07-28
hxxp://120.46.12.14/pty3onlinemalware_download2026-07-28
hxxp://1.92.136.152/pty10onlinemalware_download2026-07-28
hxxp://123.249.20.250/pty4onlinemalware_download2026-07-28
hxxp://1.92.136.152/pty4onlinemalware_download2026-07-28
hxxp://120.46.12.14/pty10onlinemalware_download2026-07-28
hxxp://1.94.221.183/pty10onlinemalware_download2026-07-28
hxxp://113.45.17.8/pty10onlinemalware_download2026-07-28
hxxp://82.156.56.214:8080/pty10onlinemalware_download2026-07-28
hxxp://34.88.165.144:8080/pty10onlinemalware_download2026-07-28
hxxp://116.205.168.247/pty10onlinemalware_download2026-07-28
hxxp://120.46.15.254/pty3onlinemalware_download2026-07-28
hxxp://116.205.168.247/pty3onlinemalware_download2026-07-28
hxxp://1.95.51.146/pty3onlinemalware_download2026-07-28
hxxp://114.132.77.127:8080/pty4onlinemalware_download2026-07-28
hxxp://123.249.20.250/pty10onlinemalware_download2026-07-28

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: censys
let malicious_domains = dynamic(["1.95.51.146", "120.46.15.254", "82.156.56.214", "1.94.221.183", "120.46.12.14", "159.112.183.71", "1.92.136.152", "139.159.233.200", "34.88.165.144", "113.45.17.8", "114.132.77.127", "123.249.20.250", "116.205.168.247"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["1.95.51.146", "120.46.15.254", "82.156.56.214", "1.94.221.183", "120.46.12.14", "159.112.183.71", "1.92.136.152", "139.159.233.200", "34.88.165.144", "113.45.17.8", "114.132.77.127", "123.249.20.250", "116.205.168.247"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: censys Malicious URLs rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://urlhaus.abuse.ch/