Actor
Malware and related tools use public IP check services to enumerate victim external IP addresses for reconnaissance and situational awareness.