Target IP Geolocation Lookup Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects HTTP requests to known IP geolocation lookup services (ip-api.com, ipinfo.io, ipgeolocation.io). A high frequency of such requests from a single source IP within a short timeframe (10 requests in 60 seconds) could indicate reconnaissance activity, where an attacker is gathering information about target IP addresses.