MiniRAT C2 Public IP-Lookup Callouts

H Fang@Fangtastic

•updated Jun 29, 2026•7•0•23

[IOC based] Surfaces every macOS host that contacts api.ipify.org or ipinfo.io/json. These are MiniRAT's exfiltration endpoints but are also used by many legitimate tools.