Remcos RAT Geolocation API Lookup and System Discovery from Injection Host

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects network connections to common IP lookup services (e.g., ip-api.com, ipify.org) initiated by processes often associated with malware, such as Remcos RAT components or hijacked system processes like iexplore.exe. This activity is frequently used by adversaries for reconnaissance or C2 heartbeats to identify the external IP address of a compromised host.