System Geographic Location Queried via IP Lookup
This rule detects attempts to query system geographic location information by monitoring HTTP requests to known IP lookup services such as ip-api.com, ipinfo.io, and freegeoip. The rule triggers an alert if five or more such requests are observed from the same source within a 30-second window, indicating potential reconnaissance or network scanning activity.
Suricata
