TokenGrabber Stealer: Public-IP Geolocation Lookup Chain (ipify to ip-api.com)

Ankit Mehta@Secvyn

•updated Sep 28, 2026•0•0•1

Detects malicious network activity associated with TokenGrabber stealer malware, specifically identifying outbound HTTP requests to public IP lookup services (api.ipify.org) followed by chained geolocation lookups (ip-api.com). This behavior is characteristic of an initial reconnaissance phase where the malware determines the victim's external network footprint.