Suspicious Curl/Wget HTTP Call to Non-RFC1918 Dot-Quad or Hex-Encoded IPv4 Address

Marcus Mingo@meeengoh

•updated Feb 9, 2026•5•2•106

Detects curl or wget execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges, APIPA, and local loopback. Threat actors commonly use raw or hex IP literals to bypass domain-based filtering and download staged payloads.