This hypothesis targets the Mozi botnet, a prevalent IoT and Linux malware family that leverages compromised endpoints to establish command-and-control channels via known malicious URLs. Proactively hunting for these specific URL indicators in Azure Sentinel allows the SOC to identify compromised assets early, preventing the botnet from executing lateral movement or exfiltrating data before it can fully integrate into the network.
Threat: Mozi Total URLs: 19 Active URLs: 18
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://125.46.145.9:35761/i | online | malware_download | 2026-09-26 |
hxxp://203.177.28.149:37669/bin.sh | online | malware_download | 2026-09-26 |
hxxp://219.156.92.2:46083/i | online | malware_download | 2026-09-26 |
hxxp://219.156.92.2:46083/bin.sh | online | malware_download | 2026-09-26 |
hxxp://42.231.71.197:35171/bin.sh | online | malware_download | 2026-09-26 |
hxxp://219.157.191.23:39761/i | online | malware_download | 2026-09-26 |
hxxp://39.38.202.122:56017/i | online | malware_download | 2026-09-26 |
hxxp://59.96.139.118:55543/i | online | malware_download | 2026-09-26 |
hxxp://123.7.221.129:46601/i | online | malware_download | 2026-09-26 |
hxxp://61.54.40.139:57666/bin.sh | online | malware_download | 2026-09-26 |
hxxp://59.96.139.118:55543/bin.sh | online | malware_download | 2026-09-26 |
hxxp://182.179.193.124:39492/Mozi.m | online | malware_download | 2026-09-26 |
hxxp://222.140.160.32:54198/i | online | malware_download | 2026-09-26 |
hxxp://196.217.5.142:59028/i | online | malware_download | 2026-09-26 |
hxxp://109.63.128.197:41019/i | online | malware_download | 2026-09-26 |
hxxp://109.63.128.197:41019/bin.sh | online | malware_download | 2026-09-26 |
hxxp://61.52.158.118:44887/bin.sh | online | malware_download | 2026-09-26 |
hxxp://59.97.253.202:53557/i | offline | malware_download | 2026-09-26 |
hxxp://119.179.251.197:44155/i | online | malware_download | 2026-09-26 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["61.54.40.139", "119.179.251.197", "125.46.145.9", "39.38.202.122", "182.179.193.124", "203.177.28.149", "219.156.92.2", "123.7.221.129", "222.140.160.32", "219.157.191.23", "196.217.5.142", "109.63.128.197", "61.52.158.118", "42.231.71.197", "59.96.139.118"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["61.54.40.139", "119.179.251.197", "125.46.145.9", "39.38.202.122", "182.179.193.124", "203.177.28.149", "219.156.92.2", "123.7.221.129", "222.140.160.32", "219.157.191.23", "196.217.5.142", "109.63.128.197", "61.52.158.118", "42.231.71.197", "59.96.139.118"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Jenkins, GitLab, or GitHub-Actions, or restrict the detection to only interactive browser sessions (excluding service accounts).*.internal.corp.com) and exclude processes like powershell.exe, curl.exe, or wget.exe when the destination is an internal IP.nessus.exe, qualys_agent.exe, nmap) or limit the detection to non-service accounts and interactive logins.