Link: Numeric IP obfuscation in URL

calendar Sep 8, 2026  ยท
Share on: linkedin copy

Detects inbound messages containing links where the host is a numeric-only IP representation, commonly used to bypass domain-based URL filtering.

Sublime rule (View on GitHub)

 1name: "Link: Numeric IP obfuscation in URL"
 2description: "Detects inbound messages containing links where the host is a numeric-only IP representation, commonly used to bypass domain-based URL filtering."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.scheme == "http"
 9          and any(.href_url.ip.translation.encoders,
10                  . in ('octal', 'decimal_integer')
11          )
12  )  
13attack_types:
14  - "Credential Phishing"
15  - "Malware/Ransomware"
16tactics_and_techniques:
17  - "Evasion"
18detection_methods:
19  - "URL analysis"
20id: "7d639d89-02ee-5729-8d6d-67a963fa5861"
to-top