URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The detection identifies potential ClearFake malicious URLs that adversaries may use to deliver malware or phishing payloads. SOC teams should proactively hunt for these URLs in Azure Sentinel to disrupt adversary campaigns and protect organizational assets before compromise.

IOC Summary

Threat: ClearFake Total URLs: 15 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["xtktlprb.rial.bet", "tdfzyex.amoozeshagazade.shop", "nljdiefg.jamjahani.football", "lq8j82kc.shirbetfarsi.com", "llonnk.bankefile.com", "ithfkpx.amoozeshtagipour.shop", "azj9wm5k.fununetadris.shop", "krezxpiv.jamjahani2026.football", "3yl7mt55.andisheeslami2.xyz", "pfyfyt.bankefiile.com", "1yusfrvk.pishbinibet.bet", "gng97m36.angizeshfarahani.store", "xqbzvgfy.red90.casino", "yovejfu.amlakshahri.xyz", "lzkgofe.akhlagvaahkam.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["xtktlprb.rial.bet", "tdfzyex.amoozeshagazade.shop", "nljdiefg.jamjahani.football", "lq8j82kc.shirbetfarsi.com", "llonnk.bankefile.com", "ithfkpx.amoozeshtagipour.shop", "azj9wm5k.fununetadris.shop", "krezxpiv.jamjahani2026.football", "3yl7mt55.andisheeslami2.xyz", "pfyfyt.bankefiile.com", "1yusfrvk.pishbinibet.bet", "gng97m36.angizeshfarahani.store", "xqbzvgfy.red90.casino", "yovejfu.amlakshahri.xyz", "lzkgofe.akhlagvaahkam.xyz"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a ClearFake URL as part of a security training exercise.
  Filter/Exclusion: Exclude URLs that match the domain training.example.com or any subdomains under it.

• Scenario: A scheduled job runs a script to fetch and validate URLs from a trusted internal source, which includes URLs tagged as ClearFake.
  Filter/Exclusion: Exclude URLs that originate from the internal domain internal-api.corp.example.com or match the IP range 10.0.0.0/8.

• Scenario: A security tool like OSSEC or Splunk is configured to send test alerts to the SOC team, including URLs tagged as ClearFake as part of its alerting mechanism.
  Filter/Exclusion: Exclude URLs that contain the string test-alert or are sourced from the internal tool security-alerts.example.com.

• Scenario: A user is accessing a legitimate URL from a third-party service (e.g., Google Drive or Dropbox) that is mistakenly flagged as ClearFake due to a misconfigured URLhaus entry.
  Filter/Exclusion: Exclude URLs that match the domains drive.google.com, dropbox.com, or any other known legitimate cloud storage services.

• Scenario: A system is running a PowerShell script or Python script that generates temporary URLs for internal testing, which are later tagged as ClearFake.
  Filter/Exclusion: Exclude URLs that contain the substring temp-url or are generated by the script internal-test-url-generator.py.