Toy Ghouls bird-agent backdoor IP/geolocation lookup via ip-api.com

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•2

Detects outbound network traffic from a potential backdoor known as 'Toy Ghouls' (bird-agent) to the ip-api.com service, likely used for geolocation-based reconnaissance or target validation.