← Back to SOC feed Coverage →

URLhaus: malware_download Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-06-09T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may be using known malicious URLs to download malware into the network, leveraging compromised or phishing-based delivery methods. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential malware infections before they spread.

IOC Summary

Threat: malware_download Total URLs: 21 Active URLs: 10

URLStatusThreatDate Added
hxxps://pub-340aa1a9ccc64f6b871a4c31ff93a5a6.r2.dev/DEDEwidth1234.pngofflinemalware_download2026-06-09
hxxp://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/HnDvE/offlinemalware_download2026-06-09
hxxps://dawn-bush-ddd1.yasminanthonyy.workers.dev/dNLRPofflinemalware_download2026-06-09
hxxp://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/pKTrGonlinemalware_download2026-06-09
hxxp://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/mcslbonlinemalware_download2026-06-09
hxxps://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/jsPtGonlinemalware_download2026-06-09
hxxps://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/xiykSonlinemalware_download2026-06-09
hxxp://104.168.70.165/22/img_102554.pngonlinemalware_download2026-06-09
hxxp://31.77.57.234/180/img_185101.pngonlinemalware_download2026-06-09
hxxps://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/fWdrAonlinemalware_download2026-06-09
hxxps://getabre.com/NDYNuwofflinemalware_download2026-06-09
hxxps://pub-e2490b2d81b147ac978f21eab73fe8c4.r2.dev/lasaas.pngonlinemalware_download2026-06-09
hxxp://104.168.70.165/22/wedidbestthingswithbetterplaceformygirl.htaofflinemalware_download2026-06-09
hxxps://getabre.com/wDUtLvofflinemalware_download2026-06-09
hxxp://31.77.57.234/180/wegivenbestthingsforbetterplaceforme.htaofflinemalware_download2026-06-09
hxxp://31.77.57.234/httpswww.pcmag.compicksthe-best-cloud-storage-and-file-sharing-servicestest_uuid=05ZUPUtSJIjL9ET37tWfQcl&test_variant=APP.phpofflinemalware_download2026-06-09
hxxps://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/sqxOiofflinemalware_download2026-06-09
hxxps://pub-ad9c25de14a347bf8934835d655aafc1.r2.dev/FILAI.pngonlinemalware_download2026-06-09
hxxp://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/WrkWFonlinemalware_download2026-06-09
hxxp://104.168.70.165/httpswww.pcmag.compicksthe-best-cloud-storage-and-file-sharing-servicestest_uuid=05ZUPUtSJIjL9ET37tWfQcl&test_variant=EVC.phpofflinemalware_download2026-06-09
hxxp://27.215.55.30:60914/bin.shofflinemalware_download2026-06-09

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev", "pub-e2490b2d81b147ac978f21eab73fe8c4.r2.dev", "104.168.70.165", "31.77.57.234", "pub-ad9c25de14a347bf8934835d655aafc1.r2.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev", "pub-e2490b2d81b147ac978f21eab73fe8c4.r2.dev", "104.168.70.165", "31.77.57.234", "pub-ad9c25de14a347bf8934835d655aafc1.r2.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/