Internet Connectivity Check via External IP Lookup
This rule detects attempts by a client on the home network to check internet connectivity by querying external IP lookup services over HTTP. It specifically looks for requests to domains like api.ipify.org, ifconfig.me, checkip.amazonaws.com, and icanhazip.com. A threshold is set to trigger an alert if five such requests are observed from the same source within 30 seconds, indicating a potential network scan or reconnaissance activity.
Suricata
