This hunt targets adversary behavior where attackers leverage ClearFake-tagged malicious URLs to distribute malware or conduct phishing campaigns within the organization’s network traffic. Proactively hunting for these specific indicators in Azure Sentinel is critical because early identification of this known threat family allows security teams to block compromised endpoints before lateral movement occurs, mitigating potential data exfiltration risks.
Threat: ClearFake Total URLs: 25 Active URLs: 0
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxps://biirwl32.patxisdublin.com/?ublib=db9ead36-2332-4c11-96aa-88e14d48d101 | offline | malware_download | 2026-07-20 |
hxxps://tq6ay9c3.broadwaylotterytickets.com/?ublib=49682f49-749f-4eb4-9c18-2b6fa139cf0d | offline | malware_download | 2026-07-20 |
hxxps://okv4iaii.contempoconstructiontx.com/?ublib=bf899dc8-3970-44c6-91d9-ef98725bc672 | offline | malware_download | 2026-07-20 |
hxxps://fgsnlppf.jadoou.lat/?ublib=64a192c0-962c-424d-903e-54510a2da4a6 | offline | malware_download | 2026-07-20 |
hxxps://giwl.highkickstkd.com/1854155f-d746-43c7-b8ec-ebfee2db5006 | offline | malware_download | 2026-07-20 |
hxxps://tgbft.countertops-dfw.com/fbc720fb-1dca-49ce-83bf-4b62ae663821 | offline | malware_download | 2026-07-20 |
hxxps://3efofny3.cielohillsevents.com/?ublib=48c99f5d-2c24-469f-b1b2-095893b78703 | offline | malware_download | 2026-07-20 |
hxxps://hpnohznb.site-takhtenard-sharti-betland.com/?ublib=5a6f7179-e8d9-4949-a37f-724f98152a89 | offline | malware_download | 2026-07-20 |
hxxps://u9p8kb56.crvbl.com/?ublib=fa9bfa8f-5f78-4b54-8810-4b0b3e1f13a9 | offline | malware_download | 2026-07-20 |
hxxps://wnq8bmsb.derbi.promo/?ublib=8bff6e51-a5c7-4d41-966d-686e393c380b | offline | malware_download | 2026-07-20 |
hxxps://f9e2ff2h.site-asli-bedon-filter-1xbet.com/?ublib=80a0a0ac-39d2-4817-b176-b4bc034397c4 | offline | malware_download | 2026-07-20 |
hxxps://ddsr.hieliao-app.com/e5030470-e5b7-4f76-9985-68492a2a4f65 | offline | malware_download | 2026-07-20 |
hxxps://cnxst.jardins-do-mar.com/7195a1bf-198e-464d-a125-53d64356e8df | offline | malware_download | 2026-07-20 |
hxxps://ryr4q9kj.playantwatch.com/?ublib=17f39272-8c03-4f09-9605-cfb437a6ab64 | offline | malware_download | 2026-07-20 |
hxxps://jsthk.jademckenzieco.com/767003a7-808a-44f3-96a8-06b1aefb8529 | offline | malware_download | 2026-07-20 |
hxxps://cyki.hayleymarienorman.com/b3e609f1-7db6-4646-9c1c-e6ff8e560403 | offline | malware_download | 2026-07-20 |
hxxps://twyd6y14.elizabethspizzadenton.com/?ublib=19d3ce96-d829-4f78-82bd-ef47d3af9900 | offline | malware_download | 2026-07-20 |
hxxps://01ejjpa2.behtarin-site-shartbandi.com/?ublib=b569c285-0ed2-48fa-b99b-9e2498ac378c | offline | malware_download | 2026-07-20 |
hxxps://pkspm.informatik-ai.com/92325a4a-031c-4206-b22d-42df3d927987 | offline | malware_download | 2026-07-20 |
hxxps://todn.hansikaenterprises.com/0e6d4bb4-bae9-405d-a7d8-3ea1327fd00c | offline | malware_download | 2026-07-20 |
hxxps://oqtr.haleywoodportfolio.com/0c513135-179c-4442-a973-e64e3ff22b23 | offline | malware_download | 2026-07-20 |
hxxps://tztgw.impactpromotionsclt.com/8971a430-05a1-4072-98c9-7f006923be63 | offline | malware_download | 2026-07-20 |
hxxps://t13ecldw.calculadoracomisiones.com/?ublib=6ce8654e-3676-4219-a88d-c679f847ec26 | offline | malware_download | 2026-07-20 |
hxxps://llttu.hurtigegevinster.com/3fc67304-49bd-411c-ab54-e8391c49f309 | offline | malware_download | 2026-07-20 |
hxxps://rbnz.hairbyniki.com/3592ab2a-0efd-4e5d-840d-1cc981c86e62 | offline | malware_download | 2026-07-20 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["oqtr.haleywoodportfolio.com", "pkspm.informatik-ai.com", "todn.hansikaenterprises.com", "giwl.highkickstkd.com", "okv4iaii.contempoconstructiontx.com", "hpnohznb.site-takhtenard-sharti-betland.com", "f9e2ff2h.site-asli-bedon-filter-1xbet.com", "tztgw.impactpromotionsclt.com", "01ejjpa2.behtarin-site-shartbandi.com", "ryr4q9kj.playantwatch.com", "jsthk.jademckenzieco.com", "cnxst.jardins-do-mar.com", "t13ecldw.calculadoracomisiones.com", "biirwl32.patxisdublin.com", "ddsr.hieliao-app.com", "cyki.hayleymarienorman.com", "tq6ay9c3.broadwaylotterytickets.com", "u9p8kb56.crvbl.com", "3efofny3.cielohillsevents.com", "wnq8bmsb.derbi.promo", "tgbft.countertops-dfw.com", "fgsnlppf.jadoou.lat", "rbnz.hairbyniki.com", "llttu.hurtigegevinster.com", "twyd6y14.elizabethspizzadenton.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["oqtr.haleywoodportfolio.com", "pkspm.informatik-ai.com", "todn.hansikaenterprises.com", "giwl.highkickstkd.com", "okv4iaii.contempoconstructiontx.com", "hpnohznb.site-takhtenard-sharti-betland.com", "f9e2ff2h.site-asli-bedon-filter-1xbet.com", "tztgw.impactpromotionsclt.com", "01ejjpa2.behtarin-site-shartbandi.com", "ryr4q9kj.playantwatch.com", "jsthk.jademckenzieco.com", "cnxst.jardins-do-mar.com", "t13ecldw.calculadoracomisiones.com", "biirwl32.patxisdublin.com", "ddsr.hieliao-app.com", "cyki.hayleymarienorman.com", "tq6ay9c3.broadwaylotterytickets.com", "u9p8kb56.crvbl.com", "3efofny3.cielohillsevents.com", "wnq8bmsb.derbi.promo", "tgbft.countertops-dfw.com", "fgsnlppf.jadoou.lat", "rbnz.hairbyniki.com", "llttu.hurtigegevinster.com", "twyd6y14.elizabethspizzadenton.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule, tailored for an enterprise environment using Hunt packages and URL reputation feeds.
Automated Security Scanner Probes
source_host or process_name. Exclude traffic originating from the specific IP ranges of your vulnerability management appliances and processes named nessus.exe, qualys-protect-agent, or rapid7-scanner.Patch Management Repository Sync
ccmexec.exe (SCCM) or ivagent.exe, specifically when the destination port is 443 and the user context is a service account (e.g., DOMAIN\svc_patch_manager).Endpoint Protection Cloud Signatures