Cyberpediaby Brain
ENDEFR

IP Address, IPv4 and IPv6

What an IP address tells others about an organization, what it does not, IPv4 and IPv6, and the steps an employee can take.

In 30 seconds

Where it happens
Whenever an IP address of the organization is exposed or collected, by direct means as well as through online datasets1.
What the attacker wants
To infer the size of the organization, the location of its sites and the hosting of its services visible from the Internet1.
The reflex
Do not share the company's network addresses, and report any unusual connection alert to the IT department.
If it is already done
Tell the IT department, which can judge whether the address that was shared is exposed.

What it is

An IP address identifies a machine or a service on a network. This page explains what the address tells an outsider about an organization, what it does not tell, and what an employee can do to avoid saying more than necessary.

The sources gathered for this page are security documents (NIST, MITRE, CISA, Microsoft). None of them describes in detail how NAT works or the CNIL's position on the IP address: these points are therefore not covered here.

Straight answers

What are IPv4 and IPv6?

They are two versions of the IP protocol. NIST cites the exhaustion of the IPv4 address space and an OMB mandate for US federal agencies as reasons for writing its guide, and states that IPv6 is not backward compatible with IPv42. An organization that adopts it must therefore change its network infrastructure and its systems2.

What does an IP address reveal?

According to MITRE, public IP addresses may be assigned to an organization in blocks, that is, in ranges of consecutive addresses1. From them, an adversary can infer the size of the organization, the physical location of its sites, its Internet service provider, and where and how its infrastructure visible from the Internet is hosted1.

What does it not reveal?

The sources cited here describe what the address allows one to infer about an organization. None of them says that it gives a person's name.

Does a VPN make you anonymous?

The sources do not say so. NIST presents the IPsec VPN as a way to protect communications and to reduce the risks of transmitting sensitive information over networks5. CISA recommends, when an update must go through an untrusted network (airport, hotel, café), using a VPN to a trusted network7.

How does a company keep track of its addresses?

In Windows Server environments, the IPAM feature is used to plan, deploy, manage and monitor the IP address infrastructure, and it automatically discovers the IP address and DNS servers on the network3.

1How it works1 min

MITRE specifies that information about assigned addresses can also appear in online datasets or datasets open to everyone1. This exposure is not easy to fix: MITRE writes that the technique cannot be easily mitigated with preventive controls, because it relies on behaviors outside the enterprise's perimeter, and recommends reducing the amount and sensitivity of data available to third parties1.

The firewall controls the flow of traffic between networks or machines that do not have the same security posture4. NIST details its types, its advantages and its limits in its guide on firewalls4.

Attackers also use relays, called proxies. A proxy acts as an intermediary between systems, and adversaries use it to avoid a direct connection to their own infrastructure6. They can chain several proxies to better hide the source of the malicious traffic6. An address seen in a log is therefore not always that of the real perpetrator.

2What you do1 min
  • Do not give out the company's network addresses (ranges, server addresses) in a message, a forum or a form. MITRE recommends limiting the data available to third parties1.
  • Report an unusual connection alert to the IT department, even if it seems harmless.
  • Use the VPN provided by the company when you have to work on an untrusted network. CISA recommends avoiding updates on an untrusted network and, if that is impossible, going through a VPN to a trusted network7.
  • Install updates as soon as they are available: CISA specifies that attackers can target flaws for months, even years, after a patch is published7.
  • Download updates only from the vendor's website, never from a link received by email7.
3Pitfalls1 min

Believing that an address proves who carried out an action. Adversaries chain proxies to disguise the source of traffic6. The address seen by the victim can therefore be that of a relay.

Believing that an address is worthless. It can help an attacker locate the hosting of services visible from the Internet, and MITRE lists this collection among the steps that can lead to initial access1.

Believing that a VPN solves everything. NIST describes IPsec as a network-layer security control5.

4Real cases1 min

Wiper attacks in Poland, 2025

MITRE reports that, during the 2025 wiper attacks in Poland, the adversaries used the tools rsocx.exe and r.exe to establish a tunnel into the internal infrastructure by means of a reverse SOCKS proxy6.

Address collection by known groups

MITRE gives three examples with no date of their own. The Magic Hound group captured the IP addresses of visitors to its phishing sites1. HAFNIUM obtained the IP addresses of publicly accessible Exchange servers1. Andariel limited its watering hole attacks to specific IP address ranges1.

Fact sheet

Identifier
CP-465
Wing
3. Protocols and defence
Brain skill
Understanding Cyberspace (understand_cyberspace)
Brain reflex
cr-034
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. MITRE ATT&CK, “Gather Victim Network Information: IP Addresses”. https://attack.mitre.org/techniques/T1590/005/ (accessed 3 November 2026)
  2. NIST, “Guidelines for the Secure Deployment of IPv6”, 29 December 2010. https://csrc.nist.gov/pubs/sp/800/119/final (accessed 3 November 2026)
  3. Microsoft, “Gestion des adresses IP (IPAM)”, 14 August 2025. https://learn.microsoft.com/fr-fr/windows-server/networking/technologies/ipam/ipam-top (accessed 3 November 2026)
  4. NIST, “Guidelines on Firewalls and Firewall Policy”, 28 September 2009. https://csrc.nist.gov/pubs/sp/800/41/r1/final (accessed 3 November 2026)
  5. NIST, “Guide to IPsec VPNs”, 30 June 2020. https://csrc.nist.gov/pubs/sp/800/77/r1/final (accessed 3 November 2026)
  6. MITRE ATT&CK, “Proxy”. https://attack.mitre.org/techniques/T1090/ (accessed 3 November 2026)
  7. CISA, “Understanding Patches and Software Updates”, 23 February 2023. https://www.cisa.gov/news-events/news/understanding-patches-and-software-updates (accessed 3 November 2026)

Cite this article

Brain, “IP Address, IPv4 and IPv6”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/ip-address-nat-ipv4-ipv6/

BibTeX 
@misc{brain_cp465_en_2026,
  author = {Brain},
  title = {IP Address, IPv4 and IPv6},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/ip-address-nat-ipv4-ipv6/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence