Suspicious CMD HTTP Call to Non-RFC1918 Dot-Quad or Hex-Encoded IPv4 Address

Marcus Mingo@meeengoh

•updated Dec 1, 2025•3•1•48

Detects cmd.exe execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges. Threat actors commonly use raw or hex IP literals to avoid domain filtering and deliver staged payloads.