Grandoreiro VBS Geofenced Dropper: Script Host + ip-api.com Geolocation Check

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects instances where Windows Script Host (wscript.exe or cscript.exe) initiates a DNS query to 'ip-api.com' within a 5-minute window. This behavior is often associated with reconnaissance activity, where an adversary uses scripts to determine the public IP address or geolocation of the compromised host for C2 registration or environment awareness.