What is IP-based command and control?¶

IP-based command and control contacts a numerical network address directly rather than first resolving a domain. The address is a routing destination, not an automatic identifier of one server or offender.

Put the connection in context¶

Preserve source device and process, destination address, port, protocol, exact time, result, volume and resulting activity. Linked certificates or domains and provider records can help identify the resource used at that moment.

An address may represent shared cloud hosting, network translation, a proxy, compromised device or reassigned server. Provider requests therefore need time, port, protocol and customer or resource identifiers, not the address alone.

Prove the control relationship¶

A known-malicious address strengthens a hypothesis but does not reveal command content. Traffic may be blocked, one-way or unrelated. Similar process context and timing across several compromised devices can add corroboration.

Track address changes and infrastructure rotation during the incident so related destinations are not treated as independent merely because the numerical address differs.