A direct-to-IP connection is a network session that targets a raw IP address instead of a domain name. The client sends traffic straight to the numeric address, so there is no DNS lookup to resolve first.
This matters in cyber security because DNS logging, passive DNS, and sinkholing are common ways to spot suspicious destinations early. Malware and command-and-control tooling may use direct-to-IP connections to bypass that visibility layer and reduce the traces analysts can correlate. Defenders usually look for public IP connections with no recent matching DNS query, then validate them against firewall, proxy, endpoint, and netflow records. The pattern is not always malicious, since many legitimate services also connect by IP, so context and asset baselines are essential.