An IPv4-mapped IPv6 address is an IPv6-formatted address that embeds a 32-bit IPv4 address, usually written like ::ffff:192.0.2.10. It is used in dual-stack environments so software can treat IPv4 endpoints through IPv6-capable interfaces and APIs. The mapping keeps compatibility without changing the underlying IPv4 host.
In cyber security, this format matters because logs, sensors, and detection rules may store or compare addresses differently than analysts expect. A hunt for outbound traffic, proxy use, or command-and-control connections can miss activity if a query only matches plain IPv4 text and not the mapped IPv6 form. Defenders should normalize address formats before correlation, parsing, or alerting so the same endpoint is recognized consistently. Attackers do not need to invent this format; they can benefit when tooling or searches handle mixed address representations poorly.