← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-07-18T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets adversaries leveraging known 32-bit malicious web endpoints to deliver payloads or establish command-and-control channels within our Azure Sentinel environment. Proactively hunting for these specific URLhaus indicators is critical because they represent a high-severity threat vector that may bypass standard perimeter defenses, requiring immediate investigation to prevent lateral movement and data exfiltration.

IOC Summary

Threat: 32-bit Total URLs: 56 Active URLs: 54

URLStatusThreatDate Added
hxxp://110.36.93.182:53790/ionlinemalware_download2026-07-18
hxxp://138.255.10.120:57405/ionlinemalware_download2026-07-18
hxxp://110.37.70.50:43380/ionlinemalware_download2026-07-18
hxxp://138.255.10.120:57405/bin.shonlinemalware_download2026-07-18
hxxp://182.122.232.148:54079/ionlinemalware_download2026-07-18
hxxp://110.36.93.182:53790/bin.shonlinemalware_download2026-07-18
hxxp://110.37.70.50:43380/bin.shonlinemalware_download2026-07-18
hxxp://36.70.71.191:47231/ionlinemalware_download2026-07-18
hxxp://110.37.76.64:39898/bin.shonlinemalware_download2026-07-18
hxxp://182.122.232.148:54079/bin.shonlinemalware_download2026-07-18
hxxp://182.116.116.107:37779/ionlinemalware_download2026-07-18
hxxp://42.178.63.166:32836/ionlinemalware_download2026-07-18
hxxp://27.213.10.249:50903/ionlinemalware_download2026-07-18
hxxp://123.129.132.137:35336/bin.shonlinemalware_download2026-07-18
hxxp://110.181.234.147:34711/ionlinemalware_download2026-07-18
hxxp://42.178.63.166:32836/bin.shonlinemalware_download2026-07-18
hxxp://115.54.124.147:57484/bin.shonlinemalware_download2026-07-18
hxxp://39.74.37.178:39605/ionlinemalware_download2026-07-18
hxxp://219.157.234.137:51727/bin.shonlinemalware_download2026-07-18
hxxp://110.181.234.147:34711/bin.shonlinemalware_download2026-07-18
hxxp://39.74.37.178:39605/bin.shonlinemalware_download2026-07-18
hxxp://113.231.16.102:48284/bin.shonlinemalware_download2026-07-18
hxxp://120.28.200.112:52763/ionlinemalware_download2026-07-18
hxxp://110.38.207.66:48927/ionlinemalware_download2026-07-18
hxxp://110.38.207.66:48927/bin.shonlinemalware_download2026-07-18

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["115.54.124.147", "27.213.10.249", "219.157.234.137", "42.178.63.166", "182.116.116.107", "115.57.44.82", "138.255.10.120", "182.122.232.148", "123.129.132.137", "39.74.37.178", "110.37.70.50", "110.181.234.147", "42.232.101.158", "113.231.16.102", "36.70.71.191", "110.37.76.64", "115.203.230.54", "120.28.200.112", "110.36.93.182", "110.38.207.66"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.54.124.147", "27.213.10.249", "219.157.234.137", "42.178.63.166", "182.116.116.107", "115.57.44.82", "138.255.10.120", "182.122.232.148", "123.129.132.137", "39.74.37.178", "110.37.70.50", "110.181.234.147", "42.232.101.158", "113.231.16.102", "36.70.71.191", "110.37.76.64", "115.203.230.54", "120.28.200.112", "110.36.93.182", "110.38.207.66"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

Original source: https://urlhaus.abuse.ch/