← Back to SOC feed Coverage →

URLhaus: malware_download Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-09-18T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis targets adversaries who leverage known malicious download URLs to fetch payloads or establish initial footholds, often bypassing traditional signature-based defenses. Proactively hunting for these specific URLhaus entries in Azure Sentinel allows the SOC to identify compromised endpoints or web traffic anomalies that may have slipped past real-time detection, enabling rapid containment before lateral movement occurs.

IOC Summary

Threat: malware_download Total URLs: 32 Active URLs: 27

URLStatusThreatDate Added
hxxp://112.248.247.253:50048/bin.shonlinemalware_download2026-09-18
hxxp://175.175.71.204:60282/iofflinemalware_download2026-09-18
hxxp://221.15.15.87:41114/bin.shofflinemalware_download2026-09-18
hxxp://42.55.7.232:55832/ionlinemalware_download2026-09-18
hxxp://42.179.154.108:52470/ionlinemalware_download2026-09-18
hxxp://59.97.250.69:33684/bin.shofflinemalware_download2026-09-18
hxxp://175.175.63.177:56180/bin.shonlinemalware_download2026-09-18
hxxp://175.166.115.209:55257/bin.shonlinemalware_download2026-09-18
hxxp://95.54.82.154:29012/ionlinemalware_download2026-09-18
hxxp://180.110.39.190:3588/bin.shonlinemalware_download2026-09-18
hxxp://175.174.100.13:42309/bin.shonlinemalware_download2026-09-18
hxxp://178.206.102.22:49024/ionlinemalware_download2026-09-18
hxxp://42.6.60.216:53925/ionlinemalware_download2026-09-18
hxxp://182.126.117.243:52960/bin.shonlinemalware_download2026-09-18
hxxp://221.15.15.87:41114/iofflinemalware_download2026-09-18
hxxp://175.174.100.13:42309/ionlinemalware_download2026-09-18
hxxp://175.166.115.209:55257/ionlinemalware_download2026-09-18
hxxp://175.175.63.177:56180/ionlinemalware_download2026-09-18
hxxp://27.37.101.170:52175/ionlinemalware_download2026-09-18
hxxp://175.147.225.150:37066/ionlinemalware_download2026-09-18
hxxp://175.147.225.150:37066/bin.shonlinemalware_download2026-09-18
hxxp://27.44.145.153:53273/ionlinemalware_download2026-09-18
hxxp://163.142.93.214:42447/ionlinemalware_download2026-09-18
hxxp://175.148.2.195:45066/bin.shonlinemalware_download2026-09-18
hxxp://175.173.130.151:57947/ionlinemalware_download2026-09-18

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["182.126.117.243", "175.147.225.150", "175.146.154.144", "27.44.145.153", "95.54.82.154", "42.6.60.216", "175.166.115.209", "175.175.63.177", "180.110.39.190", "60.21.175.220", "175.173.130.151", "175.165.81.227", "175.174.100.13", "42.177.186.47", "27.37.101.170", "163.142.93.214", "178.206.102.22", "42.179.154.108", "112.248.247.253", "175.148.2.195", "42.55.7.232"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.117.243", "175.147.225.150", "175.146.154.144", "27.44.145.153", "95.54.82.154", "42.6.60.216", "175.166.115.209", "175.175.63.177", "180.110.39.190", "60.21.175.220", "175.173.130.151", "175.165.81.227", "175.174.100.13", "42.177.186.47", "27.37.101.170", "163.142.93.214", "178.206.102.22", "42.179.154.108", "112.248.247.253", "175.148.2.195", "42.55.7.232"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/