Almost Half of Malware Samples Communicate Direct to IP

This report examines the prevalence and impact of malware that bypasses DNS by making direct-to-IP (D2IP) connections, quantifying D2IP activity across 4 million dynamic analysis reports and describing multiple active threats (Phorpiex ransomware droppers, an obfuscated “\GET” exfiltration campaign, SectopRAT browser-proxy campaigns, and IoT botnets Mozi and Boatnet). It documents indicators of compromise (malicious IPs and sample hashes), operational behaviors (hard-coded IPs, payload delivery, port/IP rotation), and proposes ZT-IP—a zero-trust, DNS-sanctioned IP enforcement model—to close the DNS visibility gap.