← Back to SOC feed Coverage →

URLhaus: Mozi Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-07T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects adversary activity involving connections to known Mozi malware distribution channels by identifying traffic to a curated set of 39 malicious URLs. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate potential initial access or command-and-control communications before the malware establishes persistence on endpoints.

IOC Summary

Threat: Mozi Total URLs: 39 Active URLs: 39

URLStatusThreatDate Added
hxxp://124.131.53.180:42721/ionlinemalware_download2026-08-07
hxxp://182.121.144.189:60356/bin.shonlinemalware_download2026-08-07
hxxp://39.90.145.143:54042/bin.shonlinemalware_download2026-08-07
hxxp://125.43.35.24:55742/bin.shonlinemalware_download2026-08-07
hxxp://123.14.93.190:47055/ionlinemalware_download2026-08-07
hxxp://124.131.53.180:42721/bin.shonlinemalware_download2026-08-07
hxxp://115.48.148.245:54758/ionlinemalware_download2026-08-07
hxxp://110.37.84.212:34554/bin.shonlinemalware_download2026-08-07
hxxp://110.36.80.162:46146/ionlinemalware_download2026-08-07
hxxp://42.232.226.240:39898/ionlinemalware_download2026-08-07
hxxp://182.121.141.220:34479/ionlinemalware_download2026-08-07
hxxp://42.225.228.107:44103/bin.shonlinemalware_download2026-08-07
hxxp://42.225.228.107:44103/ionlinemalware_download2026-08-07
hxxp://182.121.141.220:34479/bin.shonlinemalware_download2026-08-07
hxxp://110.36.80.162:46146/bin.shonlinemalware_download2026-08-07
hxxp://182.113.205.38:37725/ionlinemalware_download2026-08-07
hxxp://115.61.120.117:43905/ionlinemalware_download2026-08-07
hxxp://221.15.90.244:47446/ionlinemalware_download2026-08-07
hxxp://221.1.226.175:51370/bin.shonlinemalware_download2026-08-07
hxxp://115.58.130.246:33076/bin.shonlinemalware_download2026-08-07
hxxp://125.41.8.245:37624/ionlinemalware_download2026-08-07
hxxp://124.131.154.251:35768/bin.shonlinemalware_download2026-08-07
hxxp://125.44.212.22:49662/bin.shonlinemalware_download2026-08-07
hxxp://42.239.252.36:36560/bin.shonlinemalware_download2026-08-07
hxxp://182.121.144.189:60356/ionlinemalware_download2026-08-07

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.225.228.107", "124.131.154.251", "123.14.93.190", "182.113.205.38", "125.43.35.24", "110.39.239.253", "110.39.231.36", "42.232.226.240", "124.131.53.180", "182.116.9.201", "110.37.84.212", "115.58.130.246", "182.121.144.189", "115.48.148.245", "115.61.120.117", "221.15.90.244", "182.121.141.220", "125.41.8.245", "42.239.252.36", "221.1.226.175", "110.36.80.162", "42.231.92.171", "125.44.212.22", "39.90.145.143"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.225.228.107", "124.131.154.251", "123.14.93.190", "182.113.205.38", "125.43.35.24", "110.39.239.253", "110.39.231.36", "42.232.226.240", "124.131.53.180", "182.116.9.201", "110.37.84.212", "115.58.130.246", "182.121.144.189", "115.48.148.245", "115.61.120.117", "221.15.90.244", "182.121.141.220", "125.41.8.245", "42.239.252.36", "221.1.226.175", "110.36.80.162", "42.231.92.171", "125.44.212.22", "39.90.145.143"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, tailored for a legitimate enterprise environment:

Original source: https://urlhaus.abuse.ch/