URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The detection identifies potential ClearFake malicious URLs that adversaries may use to deliver malware or phishing payloads. SOC teams should proactively hunt for these URLs in Azure Sentinel to disrupt adversarial campaigns and protect organizational assets before compromise.

IOC Summary

Threat: ClearFake Total URLs: 16 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["6f4t5lvt.fununetadris.shop", "ieemaju.akhlageslami.xyz", "kwoptitn.restaurantguideaarhus.com", "p5k42qtw.anodaz.co", "s8a20vxh.gavaedfagahe.xyz", "zhrzviveu.downloadquran.xyz", "gimomouf.red90.casino", "zyuhgbux.hugugtejarat4.xyz", "nnvavkl.bet303.promo", "fdmjhbre.jamjahani2026.football", "qnjutqs.bet303.app", "gwofphogw.differentialmamuli.store", "2chci0sm.andisheeslami2.xyz", "whjdetcc.wrfc8.com", "kv5kk9gr.angizeshfarahani.store", "yvlenqci.rial.bet"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["6f4t5lvt.fununetadris.shop", "ieemaju.akhlageslami.xyz", "kwoptitn.restaurantguideaarhus.com", "p5k42qtw.anodaz.co", "s8a20vxh.gavaedfagahe.xyz", "zhrzviveu.downloadquran.xyz", "gimomouf.red90.casino", "zyuhgbux.hugugtejarat4.xyz", "nnvavkl.bet303.promo", "fdmjhbre.jamjahani2026.football", "qnjutqs.bet303.app", "gwofphogw.differentialmamuli.store", "2chci0sm.andisheeslami2.xyz", "whjdetcc.wrfc8.com", "kv5kk9gr.angizeshfarahani.store", "yvlenqci.rial.bet"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a ClearFake URL as part of a security awareness training exercise.
  Filter/Exclusion: Exclude URLs that match the domain training.example.com or any subdomains under it.
  Note: Use a filter like url contains "training.example.com" to suppress alerts for legitimate training URLs.

• Scenario: A scheduled job runs a script that downloads a ClearFake URL to verify its legitimacy as part of a malware analysis process.
  Filter/Exclusion: Exclude URLs that are part of the internal analysis environment, such as analysis.lab.example.com.
  Note: Use a filter like url contains "analysis.lab.example.com" to suppress alerts for legitimate analysis tasks.

• Scenario: A user is accessing a ClearFake URL via a phishing simulation tool like PhishMe or KnowBe4 to test employee response.
  Filter/Exclusion: Exclude URLs that match the PhishMe or KnowBe4 sandbox domains (e.g., phishme-sandbox.example.com).
  Note: Use a filter like url contains "phishme-sandbox.example.com" to suppress alerts for legitimate phishing simulations.

• Scenario: A DevOps team is deploying a CI/CD pipeline that uses a ClearFake URL as part of a dependency resolution process.
  Filter/Exclusion: Exclude URLs that are part of the internal artifact repository, such as artifactory.example.com.
  Note: Use a filter like url contains "artifactory.example.com" to suppress alerts for legitimate CI/CD operations.

• Scenario: An admin is using a tool like curl or wget to fetch a ClearFake URL for internal testing or debugging purposes.
  Filter/Exclusion: Exclude URLs that are accessed from known internal tools or scripts, such as those in /opt/scripts/ or `/usr/local/bin