URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected URLs are part of a ClearFake campaign, which uses deceptive URLs to trick users into downloading malicious payloads. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential phishing or credential theft attacks before they lead to data exfiltration or system compromise.

IOC Summary

Threat: ClearFake Total URLs: 16 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["kazwbt9n.2026.futbol", "xcpvjq6r.cerocarey.com", "tjvdbbc.yektbet.bet", "cpteijd.yekbetiran.com", "tqdtntx.hotbet90.casino", "afdaqyu.yasbet.casino", "dlkcsdq.hotbet90app.com", "ukmcha.yasbet90.com", "ffrpwns.vbetirani.com", "lgwzmtt.yek1bet.bet", "bagkqzj.zeppelin.bet", "xeanui.x50wheel.bet", "nekdncv.usa2026.bet", "dnmjqvy.trmegapari.com", "kgebll.xenicalby6.com", "edfwndp0.chloroquineser.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["kazwbt9n.2026.futbol", "xcpvjq6r.cerocarey.com", "tjvdbbc.yektbet.bet", "cpteijd.yekbetiran.com", "tqdtntx.hotbet90.casino", "afdaqyu.yasbet.casino", "dlkcsdq.hotbet90app.com", "ukmcha.yasbet90.com", "ffrpwns.vbetirani.com", "lgwzmtt.yek1bet.bet", "bagkqzj.zeppelin.bet", "xeanui.x50wheel.bet", "nekdncv.usa2026.bet", "dnmjqvy.trmegapari.com", "kgebll.xenicalby6.com", "edfwndp0.chloroquineser.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a new URL shortener tool by visiting a few legitimate URLs from the tool’s dashboard.
  Filter/Exclusion: Exclude URLs that match the domain of the URL shortener tool (e.g., short.url or linkvertise.com) using a domain-based filter.

• Scenario: A scheduled job runs a script that downloads and processes a CSV file containing legitimate URLs from a third-party API for data analysis.
  Filter/Exclusion: Exclude URLs that originate from known data processing APIs (e.g., api.dataanalysis.com) using a source IP or domain filter.

• Scenario: An IT team member is performing a security audit and is testing the behavior of a legitimate security tool by visiting its documentation page.
  Filter/Exclusion: Exclude URLs that contain /docs/ or /support/ paths from trusted security vendors (e.g., docs.microsoft.com, support.symantec.com).

• Scenario: A developer is using a CI/CD pipeline to fetch dependencies from a private artifact repository, which includes URLs that match the ClearFake pattern.
  Filter/Exclusion: Exclude URLs that match the private repository domain (e.g., artifactory.internal.company.com) using a domain-based exclusion rule.

• Scenario: A user is accessing a legitimate phishing simulation tool that generates fake URLs for training purposes, which are tagged as ClearFake.
  Filter/Exclusion: Exclude URLs that contain the string phishing-sim or are from the training platform’s domain (e.g., train.phishing-sim.com).