hxxp://ip-api[.]com/jsonURL
Reported by 3 independent sources · first reported by Trend Micro Research · last reported
Last reported 1 month ago
What the reports say
3 reports, newest first · the exact sentence from each-
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH“…s, resolving hostnames via reverse DNS and NetBIOS, and enumerating visible machines and SMB shares.GeolocationInvoke-RestMethod hxxp://ip-api[.]com/json | Select-Object lat, loncurl hxxps://ipinfo.io/jsoncurl hxxps://ipapi.co/jsonRetrieve the infected machine's external IP address…”
-
Angry Birds: Toy Ghouls’ new toys“At startup, both backdoor versions send a GET request to hxxp://ip-api[.]com/json to determine the system’s public IP address and country of origin.”
-
Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware“Collects system and network information, and accesses hxxp://ip-api[.]com/json to gather geolocation data based on the IP address”
Indicators reported together
named in the same reports- laboo[.]booin 1 report
- broker.hivemq[.]comin 1 report
- meet.element[.]twin 1 report
- bfadbeee63a4f0bf19ec9deb8fa58f58in 1 report
- 7916c33688385525078bee504c90f359in 1 report
- 45.59.160[.]199in 1 report
- hxxps://api.github[.]com/repos/in 1 report
- tools[.]inin 1 report
- hxxps://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zipin 1 report
- jpg[.]cdin 1 report
- hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zipin 1 report
- machine[.]networkin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.