api.ipapi[.]isDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace“IP-based researcher filtering: Before any content is shown, the kit calls api.ipapi[.]is (or equivalent service) to check the visitor's IP against a blocklist of cloud/hosting providers (Leaseweb, M247, DigitalOcean, Linode, Amazon, OVH, Hetzner, Google, Microsoft, Cloudflare, Akam…”
Indicators reported together
named in the same reports- sites.google[.]comin 1 report
- token.client[.]idin 1 report
- hxxps://www.google[.]com/accounts/OAuthLoginin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.