Leaf Leaf Mod Analyzer

Raw IP Address Communication

Direct_IP_URL Malware HIGH +7 score

🎮 Minecraft Gameplay Impact

Most third-party services and modding platforms rely on registered domain names resolved via the Domain Name System (DNS). Domain names provide organizational transparency, public SSL/TLS certificate records, and domain reputation tracking.

Direct_IP_URL flags modifications that embed routable numeric IP addresses (such as http://203.0.113[.]42:8080/) directly into their network connection routines. While local network testing and private self-hosted servers sometimes use direct IP addresses, embedding public numeric IP addresses in distributed mods is uncommon. In malicious scenarios, attackers can use direct IP endpoints via standard networking APIs (like HttpURLConnection or raw sockets) to communicate with command-and-control servers or data drop points without generating DNS query logs that could be intercepted by monitoring systems or blocked via DNS sinkholes.

The presence of a hardcoded IP address does not automatically establish malicious intent, but it warrants review of the associated network protocol, data payload, and server ownership.

🔍 Functions & APIs Analyzed

ConstantPool CONSTANT_Utf8

String literal containing a public routable numeric IP address.

💻 Mod Implementation (Dev Source / Mapped) 

package com.example.network;

import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.charset.StandardCharsets;

public class DirectConnectionClient {
    private static final String ENDPOINT = "http://203.0.113[.]42:8080/sync";

    public static void sendStatusReport(String payload) {
        try {
            URL url = new URL(ENDPOINT);
            HttpURLConnection conn = (HttpURLConnection) url.openConnection();
            conn.setRequestMethod("POST");
            conn.setConnectTimeout(5000);
            conn.setDoOutput(true);

            try (OutputStream os = conn.getOutputStream()) {
                os.write(payload.getBytes(StandardCharsets.UTF_8));
            }
            conn.getResponseCode();
        } catch (Exception ignored) {
            // Обработка сетевых сбоев
        }
    }
}

🛡️ Bytecode Signature & Static Detection

The detector scans string constants in the class constant pool (CONSTANT_Utf8) for literal HTTP and HTTPS URLs that use numeric IPv4 addresses instead of domain names.

The regular expression filters out private and loopback networks (127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, and 0.0.0.0/8) to avoid flagging local developer servers and inter-process communication bindings.

Detection triggers on public, routable IP addresses embedded as string constants. The primary limitation of static inspection is that it only evaluates hardcoded URL strings: numeric IP addresses configured dynamically, constructed from byte arrays, or resolved through custom binary protocols are not identified by this rule.