Files Downloaded from URI Containing IP Address

David Dvir@BizzareC0ntact

•updated Aug 3, 2025•12•1•165

This query uses MOTW to identify users who have downloaded files from a URI that contains an IP (eg ; https://1.1.1.1/somefile.iso) Should always be suspicious! Tweak the extensions if you have other extensions in mind.