scan.now
Premium Scan a site

URL uses a raw IP address as host

The link points to a bare IP address instead of a domain name, which legitimate consumer services almost never do.

Do this: Do not trust it; real services use names, not raw IP addresses. Real services publish names; a raw address usually means a compromised host or a throwaway box.
PassThe link uses a domain name, not a raw IP address.
MediumThe link points to a raw IP address.

The fix, in one snippet

Example to adapt What it looks like 
http://185.203.116.42/login   <- no name, no certificate to check

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

The checker parses the host as an IPv4 address, including the octal, hexadecimal and single-integer forms browsers accept (http://0x7f000001/ and http://2130706433/ both mean 127.0.0.1), or as a bracketed IPv6 address. It notes whether the address is in a private or loopback range (10/8, 172.16/12, 192.168/16, 127/8, 169.254/16), which points at internal resources or a server-side request forgery lure, and whether a non-standard port is used. Severity is medium. Limits: routers, NAS boxes, development servers and some internal tools are reached by IP legitimately; the context, such as a message asking you to sign in, is what distinguishes them.

Why it matters

Domains cost money, get suspended and land on block lists; a compromised server or a rented VPS can be used directly by address for a campaign that lasts a day, with no registration record to check and nothing for a domain-based filter to match. The obfuscated numeric forms exist to confuse both people and simple filters. A URL such as http://203.0.113.5/office365/login.php is about as clear a phishing signal as exists. Anyone receiving links is exposed; people who administer their own equipment may be tempted to assume it is theirs.

How to fix it

Do not enter anything. If the address could be your own device, confirm the IP from the device's settings rather than from the message. For work services, ask IT before proceeding. Report the message. Developers and administrators: never send users links by IP address; put a hostname with a valid certificate in front of every service, including internal ones. Related: plain HTTP links. Guides: how to spot phishing and what an IP address reveals.

Where this fits

URL uses a raw IP address as host is check 10 of 13 that the phishing url checker runs under url and phishing indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Page asks for credentials (medium), where the page at the link asks for a username and password, so if anything else about the URL is off, this is where the credentials would be harvested. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

URL uses a raw IP address as host closes one route in. Immediately below it: Excessive subdomain depth, where the host has an unusually deep chain of subdomains, a pattern used to push the real domain out of sight and to mint an unlimited supply of unique hostnames; Top-level domain heavily abused for phishing, where the domain ends in a top-level domain that is disproportionately used for phishing and spam, usually because registrations there are free or very cheap; URL shortener hides the destination, where the link goes through a URL-shortening service, so the real destination is hidden until you click.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: URL uses a raw IP address as host (medium severity)
Scanner check id: url-ip-host
17 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. WHATWG URL Standard: Host parsing
  2. RFC 1918: Address Allocation for Private Internets
  3. CISA: Recognize and Report Phishing

Related guides

8 min read · Updated Sep 13, 2026 How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work

Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...

Read the guide 7 min read · Updated Sep 10, 2026 What Your IP Address Reveals and How Sites Use It

Your IP address is sent to every server you contact. What it reveals about location and provider, what it does not, how it is combined...

Read the guide