Calls to raw IP addresses
A tool call reaches an IPv4 address directly, and the address is classified against a built-in set of cloud-provider ranges.
Why it is risky
Section titled “Why it is risky”An unexplained address can hide the intended recipient from ordinary hostname review. A cloud-provider address can still belong to an attacker.
Example
Section titled “Example”An agent includes an unfamiliar numeric IP address as the upload destination for a diagnostic bundle.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rules look only at where a call goes: IPv4 hosts in URLs, IPv4 addresses passed to network programs such as curl, wget, nc, ssh, scp or rsync, and bare IPv4 addresses in a command that runs. An address inside the built-in cloud-provider ranges receives MEDIUM base severity; one outside them receives HIGH. Loopback addresses never count. An address in content written to a file, or in a search pattern, is not a destination and does not match. The rules do not require a confirmed network operation.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_OUTBOUND_KNOWN_IP | unexpected_network_destination | Community | MEDIUM |
RULE_OUTBOUND_UNKNOWN_IP | unexpected_network_destination | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Determine whether the address was actually contacted and what was sent. Verify the intended service and operator rather than trusting a provider-range classification.
False positives
Section titled “False positives”Internal service addresses and legitimate diagnostics can match, as can a command that passes an address to a network program without the connection succeeding. The range list is representative rather than exhaustive, so legitimate cloud addresses may be classified as unknown.
False negatives
Section titled “False negatives”Hostnames, IPv6 destinations, addresses written into a script or configuration file that a later process contacts, addresses excluded by the matcher, and traffic absent from captured parameters are outside these rules.
Technical details
Section titled “Technical details”Known means inside the rule range list, not known safe. Unknown means outside that list, not confirmed malicious. These rules do not measure packets or infer relevance to the user task.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.