Skip to content
Threat Feed
Subscribe
medium advisory

Suspicious DNS Queries for Public IP Lookup Services

Adversaries and malware frequently perform network reconnaissance by querying external public IP geolocation and identification services to determine the public-facing identity of an infected host.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
Medium
Action
Monitor or close
Sources
3 public sources
Freshness
Revision 1Nov 10, 02:45 UTC
Detection
1 rule
Source quality
A2Roughly even chance

Adversaries and automated malware (such as Hancitor and Ducktail) often perform reconnaissance by querying public IP identification services to obtain the external IP address of a compromised system. While these services are legitimate, their usage by non-browser processes (e.g., background scripts, PowerShell, or command-line tools) is a common indicator of host discovery and beaconing activity during the early stages of an intrusion.

Recommendation

  • Deploy the Sigma rule below to detect unauthorized processes querying common IP lookup services.
  • Baseline legitimate administrative scripts or internal agents that require external connectivity to identify public network egress points.
  • Utilize DNS query logs to identify non-browser processes communicating with these common external discovery endpoints.

Immediate actions

Deploy Sigma detection for DNS-based IP lookup discovery.

Detection Engineering 7d

Threat Hunt

Identify non-browser processes communicating with known IP discovery services via DNS logs.

T1590 medium medium confidence convert to detection

Data: DNS query logs including process image path

Detection coverage 1

Detect Suspicious DNS Query for IP Lookup Service APIs

medium

Detects DNS queries for common public IP lookup services (e.g., api.ipify.org, checkip.amazonaws.com) originating from non-browser processes.

sigma tactics: reconnaissance techniques: T1590 sources: dns_query, windows

Detection queries are available on the platform. Get full rules →