--- title: "Almost Half of Malware Samples Communicate Direct to IP" url: https://daily.dev/posts/almost-half-of-malware-samples-communicate-direct-to-ip-xvqgrqnnp source_url: https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip type: article source: "Unit 42" published: 2026-08-04T12:51:54.016Z updated: 2026-08-04T12:52:21.505Z tags: ["security", "malware"] reading_time: 11 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Almost Half of Malware Samples Communicate Direct to IP **[Unit 42](https://daily.dev/sources/unit42)** · 11 min read · 0 upvotes · 0 comments ## Summary Analysis of 4 million dynamic analysis reports reveals that 45.32% of malware samples with C2 activity bypass DNS entirely by connecting directly to hard-coded IP addresses. This 'direct-to-IP' (D2IP) behavior renders DNS-based defenses blind to nearly half of malware C2 traffic. The research introduces Zero Trust IP (ZT-IP), a network-level enforcement approach that only permits outbound connections to IP addresses previously resolved via a trusted DNS response. Real-world threats uncovered through ZT-IP analysis include Phorpiex ransomware droppers, a persistent data exfiltration campaign using obfuscated \GET HTTP requests, SectopRAT targeting educational institutions, and Mozi/Boatnet IoT botnets targeting legacy hardware across 14 architectures. Indicators of compromise and a technical appendix explaining ZT-IP mechanics are included. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Inside a TrickBot Variant Using DNS Tunneling for C2](https://daily.dev/posts/inside-a-trickbot-variant-using-dns-tunneling-for-c2-djwui3hmi) · FortiGuard Threat Research · 1 upvotes · 0 comments - [TDL 006 \| Beyond the Firewall: How Attackers Weaponize Your DNS](https://daily.dev/posts/tdl-006-beyond-the-firewall-how-attackers-weaponize-your-dns-sttwfmytk) · Security Boulevard · 0 upvotes · 0 comments - [Faster Than Real-Time: Why Your Security Fails and What to Do Next](https://daily.dev/posts/faster-than-real-time-why-your-security-fails-and-what-to-do-next-azuvclouw) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/almost-half-of-malware-samples-communicate-direct-to-ip-xvqgrqnnp)