Suspicious Windows Network Connections to External IP Lookup Service APIs

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1016System Network Configuration Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies outbound connections from Windows hosts to common external IP lookup and geolocation-related APIs (for example, ipify.org and ipinfo.io) based on the destination hostname. Attackers may use these services during discovery and testing to determine their outward-facing IP address or validate network egress behavior post-compromise. Detection relies on network connection telemetry including destination hostname and the process image to optionally suppress common browser traffic.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Suspicious Domain Trust Discovery Via Nltest

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

Suspicious Scheduled Task Enumerated (via process_creation)

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

Suspicious External IP Discovery via curl to ifconfig.me via process_creation

Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)

Suspicious Windows Network Connections to External IP Lookup Service APIs

Pivot detection · T1016 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-network-connections-to-external-ip-lookup-service-apis-edf3485d

title: Suspicious Windows Network Connections to External IP Lookup Service APIs
id: 69703635-e88b-4167-ab4a-797c7b0ad1bc
related:
  - id: ec82e2a5-81ea-4211-a1f8-37a0286df2c2
    type: derived
  - id: edf3485d-dac4-4d50-90e4-b0e5813f7e60
    type: derived
status: test
description: This rule identifies outbound connections from Windows hosts to common external IP lookup and geolocation-related APIs (for example, ipify.org and ipinfo.io) based on the destination hostname. Attackers may use these services during discovery and testing to determine their outward-facing IP address or validate network egress behavior post-compromise. Detection relies on network connection telemetry including destination hostname and the process image to optionally suppress common browser traffic.
references:
  - https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
  - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml
author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-24
modified: 2024-03-22
tags:
  - attack.discovery
  - attack.t1016
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    - DestinationHostname:
        - www.ip.cn
        - l2.io
    - DestinationHostname|contains:
        - api.2ip.ua
        - api.bigdatacloud.net
        - api.ipify.org
        - bot.whatismyipaddress.com
        - canireachthe.net
        - checkip.amazonaws.com
        - checkip.dyndns.org
        - curlmyip.com
        - db-ip.com
        - edns.ip-api.com
        - eth0.me
        - freegeoip.app
        - geoipy.com
        - getip.pro
        - icanhazip.com
        - ident.me
        - ifconfig.io
        - ifconfig.me
        - ip-api.com
        - ip.360.cn
        - ip.anysrc.net
        - ip.taobao.com
        - ip.tyk.nu
        - ipaddressworld.com
        - ipapi.co
        - ipconfig.io
        - ipecho.net
        - ipinfo.io
        - ipip.net
        - ipof.in
        - ipv4.icanhazip.com
        - ipv4bot.whatismyipaddress.com
        - ipv6-test.com
        - ipwho.is
        - jsonip.com
        - myexternalip.com
        - seeip.org
        - wgetip.com
        - whatismyip.akamai.com
        - whois.pconline.com.cn
        - wtfismyip.com
  filter_optional_brave:
    Image|endswith: \brave.exe
  filter_optional_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_optional_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_optional_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_optional_maxthon:
    Image|endswith: \maxthon.exe
  filter_optional_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_optional_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_optional_opera:
    Image|endswith: \opera.exe
  filter_optional_safari:
    Image|endswith: \safari.exe
  filter_optional_seamonkey:
    Image|endswith: \seamonkey.exe
  filter_optional_vivaldi:
    Image|endswith: \vivaldi.exe
  filter_optional_whale:
    Image|endswith: \whale.exe
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate use of the external websites for troubleshooting or network monitoring
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL