Link: Numeric IP obfuscation in URL

calendar Aug 6, 2026  ยท
Share on: linkedin copy

Detects inbound messages containing links where the host is a numeric-only IP representation, commonly used to bypass domain-based URL filtering.

Sublime rule (View on GitHub)

 1name: "Link: Numeric IP obfuscation in URL"
 2description: "Detects inbound messages containing links where the host is a numeric-only IP representation, commonly used to bypass domain-based URL filtering."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          any(.href_url.ip.translation.encoders,
 9              . in ('octal', 'decimal_integer')
10          )
11  )  
12attack_types:
13  - "Credential Phishing"
14  - "Malware/Ransomware"
15tactics_and_techniques:
16  - "Evasion"
17detection_methods:
18  - "URL analysis"
19id: "7d639d89-02ee-5729-8d6d-67a963fa5861"
to-top