What is IP-based command and control?¶
The practical answer¶
IP-based command and control uses a numerical network address directly rather than relying on a domain name.
The key evidential caution¶
The dangerous assumption is that the IP address identifies the offender or even one dedicated server.
It may not.
The address may represent:
Key points¶
- shared cloud hosting
- a proxy
- a VPN
- a compromised device
- a hosting provider
- a content-delivery node
- a reassigned server
- network address translation
Evidence to preserve¶
Investigators should preserve:
Key points¶
- the source device and process
- destination IP
- port and protocol
- timestamps
- connection result
- traffic volume
- provider and hosting data
- any linked domain or certificate
- what activity followed
A connection to a known malicious IP may support a command-and-control hypothesis.
But the same address may host unrelated services or may have changed use since the incident.
Historical provider and threat-intelligence context therefore matters.
Evidential limits¶
Do not infer command content from the address alone.
The traffic may be failed, blocked, one-way or unrelated.
Practical interpretation¶
Where several compromised systems contact the same address with similar timing and process context, the evidential picture becomes stronger.
Where the address is part of shared infrastructure, request records using the precise time, port, protocol and account or resource identifier. An address alone may be insufficient to distinguish the relevant customer or virtual server from unrelated users.
Also check whether the destination changed during the incident. Reassignment, failover or infrastructure rotation may otherwise make several addresses look unrelated.
Operational takeaway¶
Use IP contact as one layer of evidence, and establish the responsible process, historical hosting and resulting activity before treating it as command and control.