[oniony]

I've never seen square brackets used like that around a dot in an IPv4. Spent a while reading whether it was even valid to finds out it's not!

Apparently this is added by the writer/editor of the news article so that the malicious IP does not get hyperlinked so that nobody clicks it by accident.

[sifex]

Yea, the process overall has a fairly cool name as well “de-fang”. Overall it helps security teams share these indicators safely without having to worry about Slack or any other tool hyperlinking them automatically.

There are tools online to help you do this as well

https://gchq.github.io/CyberChef/#recipe=Defang_URL(true,tru...