← Back to SOC feed Coverage →

URLhaus: Mozi Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-03T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing Mozi malware to conduct stealthy data exfiltration through encrypted command-and-control channels initiated by phishing campaigns. Proactive hunting in Azure Sentinel is critical to identify early-stage espionage activities and prevent the establishment of persistent access that could lead to significant sensitive information compromise.

IOC Summary

Threat: Mozi Total URLs: 52 Active URLs: 52

URLStatusThreatDate Added
hxxp://182.116.89.39:56033/bin.shonlinemalware_download2026-08-03
hxxp://42.236.150.111:38647/ionlinemalware_download2026-08-03
hxxp://123.4.142.146:41299/bin.shonlinemalware_download2026-08-03
hxxp://115.63.49.184:52595/bin.shonlinemalware_download2026-08-03
hxxp://37.52.141.118:33120/bin.shonlinemalware_download2026-08-03
hxxp://123.5.14.158:44855/ionlinemalware_download2026-08-03
hxxp://115.55.240.192:56668/ionlinemalware_download2026-08-03
hxxp://27.206.197.243:51375/ionlinemalware_download2026-08-03
hxxp://182.113.227.205:41880/bin.shonlinemalware_download2026-08-03
hxxp://61.53.86.19:53348/ionlinemalware_download2026-08-03
hxxp://61.53.86.19:53348/bin.shonlinemalware_download2026-08-03
hxxp://182.127.37.52:42129/bin.shonlinemalware_download2026-08-03
hxxp://222.141.137.226:55091/ionlinemalware_download2026-08-03
hxxp://182.116.89.39:56033/ionlinemalware_download2026-08-03
hxxp://42.235.93.19:51785/bin.shonlinemalware_download2026-08-03
hxxp://37.52.156.110:55715/bin.shonlinemalware_download2026-08-03
hxxp://182.113.38.58:57402/bin.shonlinemalware_download2026-08-03
hxxp://42.237.100.153:55957/ionlinemalware_download2026-08-03
hxxp://112.248.127.94:37050/ionlinemalware_download2026-08-03
hxxp://222.138.234.174:50719/ionlinemalware_download2026-08-03
hxxp://123.4.142.146:41299/ionlinemalware_download2026-08-03
hxxp://182.113.3.13:55170/ionlinemalware_download2026-08-03
hxxp://182.121.10.250:38908/ionlinemalware_download2026-08-03
hxxp://182.113.38.58:57402/ionlinemalware_download2026-08-03
hxxp://42.239.188.54:48199/bin.shonlinemalware_download2026-08-03

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.235.93.19", "39.88.248.179", "42.237.100.153", "112.248.127.94", "182.121.10.250", "61.53.86.19", "125.43.230.120", "42.239.188.54", "115.63.49.184", "182.113.3.13", "115.50.148.113", "123.14.218.241", "27.206.197.243", "182.116.89.39", "222.138.234.174", "37.52.141.118", "115.55.240.192", "123.4.142.146", "182.113.38.58", "222.141.137.226", "42.236.150.111", "123.5.14.158", "182.127.37.52", "182.113.227.205", "37.52.156.110", "110.37.76.64"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.235.93.19", "39.88.248.179", "42.237.100.153", "112.248.127.94", "182.121.10.250", "61.53.86.19", "125.43.230.120", "42.239.188.54", "115.63.49.184", "182.113.3.13", "115.50.148.113", "123.14.218.241", "27.206.197.243", "182.116.89.39", "222.138.234.174", "37.52.141.118", "115.55.240.192", "123.4.142.146", "182.113.38.58", "222.141.137.226", "42.236.150.111", "123.5.14.158", "182.127.37.52", "182.113.227.205", "37.52.156.110", "110.37.76.64"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, tailored for a legitimate enterprise environment:

Original source: https://urlhaus.abuse.ch/