Almost Half of Malware Samples Communicate Direct to IP

Reported 04 Aug 2026 by otx · Severity: medium

Analysis of 4 million dynamic malware reports reveals that 45.32% of malware samples with command-and-control activity establish direct-to-IP (D2IP) connections, bypassing DNS entirely and evading DNS-based security defenses. D2IP traffic accounts for 23.17% of all C2 connection