[SOLVED] IPv4 address dot in square brackets

IPv4 address dot in square brackets

I have been asked to block IP address of the form:

1.111.1[.]111

I have never come across a dot in square brackets in IPv4. Does it have any meaning or interpretation?

Solution

Some valuable information on the topic can be found at Advanced Indicator of Compromise (IOC) extractor:

It is common practice for malware analysts or endpoint software to “defang” IOCs such as URLs and IP addresses, in order to prevent accidental exposure to live malicious content. Being able to extract and aggregate these IOCs is often valuable for analysts. Unfortunately, existing “IOC extraction” tools often pass right by them, as they are not caught by standard regex.

For example, the simple defanging technique of surrounding periods with brackets:
127[.]0[.]0[.]1
Existing tools that use a simple IP address regex will ignore this IOC entirely.

To summarize, this notation make links/ip impossible to click or use "by error" in order to mitigate the risks linked to those Indicators Of Compromise.