← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-06-28T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets adversary behavior where compromised endpoints attempt to communicate with known malicious domains specifically designed for 32-bit architectures, indicating potential legacy system exploitation or targeted malware delivery. Proactively hunting for these indicators in Azure Sentinel is critical because 32-bit environments often lack modern security controls, making them high-value entry points that require immediate isolation and forensic analysis upon detection.

IOC Summary

Threat: 32-bit Total URLs: 18 Active URLs: 17

URLStatusThreatDate Added
hxxp://39.79.77.117:49821/bin.shonlinemalware_download2026-06-28
hxxp://110.37.85.16:37012/bin.shonlinemalware_download2026-06-28
hxxp://123.5.134.91:52524/ionlinemalware_download2026-06-28
hxxp://42.238.140.134:40137/ionlinemalware_download2026-06-28
hxxp://42.238.140.134:40137/bin.shonlinemalware_download2026-06-28
hxxp://117.146.92.46:38369/ionlinemalware_download2026-06-28
hxxp://222.141.120.246:50416/ionlinemalware_download2026-06-28
hxxp://115.55.51.238:59062/ionlinemalware_download2026-06-28
hxxp://115.55.51.238:59062/bin.shonlinemalware_download2026-06-28
hxxp://222.141.120.246:50416/bin.shonlinemalware_download2026-06-28
hxxp://42.87.33.172:56771/iofflinemalware_download2026-06-28
hxxp://219.157.203.87:38635/bin.shonlinemalware_download2026-06-28
hxxp://115.48.151.200:54630/ionlinemalware_download2026-06-28
hxxp://42.230.188.82:51392/ionlinemalware_download2026-06-28
hxxp://61.53.80.118:50352/bin.shonlinemalware_download2026-06-28
hxxp://72.240.161.71:39522/bin.shonlinemalware_download2026-06-28
hxxp://115.48.151.200:54630/bin.shonlinemalware_download2026-06-28
hxxp://115.54.111.82:60002/ionlinemalware_download2026-06-28

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["42.230.188.82", "42.238.140.134", "72.240.161.71", "61.53.80.118", "117.146.92.46", "219.157.203.87", "123.5.134.91", "110.37.85.16", "222.141.120.246", "39.79.77.117", "115.48.151.200", "115.55.51.238", "115.54.111.82"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.230.188.82", "42.238.140.134", "72.240.161.71", "61.53.80.118", "117.146.92.46", "219.157.203.87", "123.5.134.91", "110.37.85.16", "222.141.120.246", "39.79.77.117", "115.48.151.200", "115.55.51.238", "115.54.111.82"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://urlhaus.abuse.ch/