Unit 42 Research: Nearly half of all malware connects directly to IP addresses

davchen — Fri, 28 Aug 2026 18:05:24 GMT

For those of you who are curious, one of the trends we've been tracking that led to the development of Advanced IP Defense is this evasive technique of malware connecting directly to IP addresses — meaning they're circumventing standard inspections on the URL or domain layers.

Check out this Unit 42 research blog digging into this trend. Also check out this threat report for the broader trends beyond direct-to-IP evasions.

topic Unit 42 Research: Nearly half of all malware connects directly to IP addresses in Advanced IP Defense Discussions

Unit 42 Research: Nearly half of all malware connects directly to IP addresses