Suspicious Windows Script Host HTTP Call to Non-RFC1918 Dot-Quad or Hex-Encoded IPv4 Address

Marcus Mingo@meeengoh

•updated Dec 1, 2025•2•1•83

Detects Windows Script Host (wscript.exe or cscript.exe) execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges, APIPA, and local loopback. Threat actors frequently use raw or hex IP literals to bypass domain-based filtering and deliver payloads via script-based loaders.