Analysis of 4 million dynamic analysis reports reveals that 45.32% of malware samples with C2 activity bypass DNS entirely by connecting directly to hard-coded IP addresses. This 'direct-to-IP' (D2IP) behavior renders DNS-based defenses blind to nearly half of malware C2 traffic. The research introduces Zero Trust IP (ZT-IP), a network-level enforcement approach that only permits outbound connections to IP addresses previously resolved via a trusted DNS response. Real-world threats uncovered through ZT-IP analysis include Phorpiex ransomware droppers, a persistent data exfiltration campaign using obfuscated \GET HTTP requests, SectopRAT targeting educational institutions, and Mozi/Boatnet IoT botnets targeting legacy hardware across 14 architectures. Indicators of compromise and a technical appendix explaining ZT-IP mechanics are included.
