← Back to SOC feed Coverage →

URLhaus: Mozi Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-09T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving the Mozi malware family by flagging network traffic to known malicious URLs that facilitate command-and-control communication or payload delivery. Proactively hunting for these indicators in Azure Sentinel is critical because Mozi’s sophisticated evasion techniques require early identification of its web-based infection vectors to prevent lateral movement and data exfiltration before full compromise occurs.

IOC Summary

Threat: Mozi Total URLs: 29 Active URLs: 29

URLStatusThreatDate Added
hxxp://59.103.116.68:54641/bin.shonlinemalware_download2026-08-09
hxxp://112.255.6.104:51842/ionlinemalware_download2026-08-09
hxxp://182.124.41.91:59176/bin.shonlinemalware_download2026-08-09
hxxp://182.124.41.91:59176/ionlinemalware_download2026-08-09
hxxp://182.127.26.190:34325/ionlinemalware_download2026-08-09
hxxp://125.44.219.81:55457/bin.shonlinemalware_download2026-08-09
hxxp://119.184.29.187:45741/ionlinemalware_download2026-08-09
hxxp://61.52.7.68:35582/bin.shonlinemalware_download2026-08-09
hxxp://27.217.3.109:54209/bin.shonlinemalware_download2026-08-09
hxxp://222.137.213.31:48901/ionlinemalware_download2026-08-09
hxxp://110.37.12.8:38162/bin.shonlinemalware_download2026-08-09
hxxp://82.48.207.52:56706/ionlinemalware_download2026-08-09
hxxp://115.52.179.220:43157/ionlinemalware_download2026-08-09
hxxp://123.9.25.110:38551/ionlinemalware_download2026-08-09
hxxp://42.227.134.211:38080/ionlinemalware_download2026-08-09
hxxp://42.224.197.152:60373/bin.shonlinemalware_download2026-08-09
hxxp://42.224.197.152:60373/ionlinemalware_download2026-08-09
hxxp://123.14.181.239:50468/ionlinemalware_download2026-08-09
hxxp://42.230.35.149:47141/ionlinemalware_download2026-08-09
hxxp://59.103.116.68:54641/ionlinemalware_download2026-08-09
hxxp://115.58.171.191:59435/ionlinemalware_download2026-08-09
hxxp://182.112.39.204:49245/ionlinemalware_download2026-08-09
hxxp://115.55.9.151:44103/bin.shonlinemalware_download2026-08-09
hxxp://125.47.244.3:55442/bin.shonlinemalware_download2026-08-09
hxxp://222.134.172.2:44618/bin.shonlinemalware_download2026-08-09

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["82.48.207.52", "115.58.171.191", "182.127.26.190", "103.160.130.178", "123.9.25.110", "42.224.197.152", "115.55.29.170", "119.184.29.187", "123.14.181.239", "182.124.41.91", "112.255.6.104", "115.54.124.37", "125.47.244.3", "61.52.7.68", "115.52.179.220", "123.8.17.147", "42.230.35.149", "222.134.172.2", "115.55.9.151", "222.137.213.31", "110.37.12.8", "42.227.134.211", "59.103.116.68", "182.112.39.204", "125.44.219.81", "27.217.3.109"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["82.48.207.52", "115.58.171.191", "182.127.26.190", "103.160.130.178", "123.9.25.110", "42.224.197.152", "115.55.29.170", "119.184.29.187", "123.14.181.239", "182.124.41.91", "112.255.6.104", "115.54.124.37", "125.47.244.3", "61.52.7.68", "115.52.179.220", "123.8.17.147", "42.230.35.149", "222.134.172.2", "115.55.9.151", "222.137.213.31", "110.37.12.8", "42.227.134.211", "59.103.116.68", "182.112.39.204", "125.44.219.81", "27.217.3.109"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusions for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment:

Original source: https://urlhaus.abuse.ch/