Suspicious DNS Query for IP Lookup Service APIs

Action1: actionname = "sa_dns_query" AND (QUERY = "www.ip.cn,l2.io" OR (QUERY contains "api.2ip.ua,api.bigdatacloud.net,api.ipify.org,bot.whatismyipaddress.com,canireachthe.net,checkip.amazonaws.com,checkip.dyndns.org,curlmyip.com,db-ip.com,edns.ip-api.com,eth0.me,freegeoip.app,geoipy.com,getip.pro,icanhazip.com,ident.me,ifconfig.io,ifconfig.me,ip-api.com,ip.360.cn,ip.anysrc.net" OR QUERY contains "ip.taobao.com,ip.tyk.nu,ipaddressworld.com,ipapi.co,ipconfig.io,ipecho.net,ipinfo.io,ipip.net,ipof.in,ipv4.icanhazip.com,ipv4bot.whatismyipaddress.com,ipv6-test.com,ipwho.is,jsonip.com,myexternalip.com,seeip.org,wgetip.com,whatismyip.akamai.com,whois.pconline.com.cn,wtfismyip.com")) AND (PROCESSNAME notendswith "\brave.exe" AND PROCESSNAME != "C:\Program Files\Google\Chrome\Application\chrome.exe,C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" AND PROCESSNAME != "C:\Program Files\Mozilla Firefox\firefox.exe,C:\Program Files (x86)\Mozilla Firefox\firefox.exe" AND PROCESSNAME != "C:\Program Files (x86)\Internet Explorer\iexplore.exe,C:\Program Files\Internet Explorer\iexplore.exe" AND PROCESSNAME notendswith "\maxthon.exe" AND (PROCESSNAME notstartswith "C:\Program Files (x86)\Microsoft\EdgeWebView\Application" AND PROCESSNAME notendswith "\WindowsApps\MicrosoftEdge.exe" AND PROCESSNAME != "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,C:\Program Files\Microsoft\Edge\Application\msedge.exe") AND (PROCESSNAME notstartswith "C:\Program Files (x86)\Microsoft\EdgeCore\,C:\Program Files\Microsoft\EdgeCore" OR PROCESSNAME notendswith "\msedge.exe,\msedgewebview2.exe") AND PROCESSNAME notendswith "\opera.exe" AND PROCESSNAME notendswith "\safari.exe" AND PROCESSNAME notendswith "\seamonkey.exe" AND PROCESSNAME notendswith "\vivaldi.exe" AND PROCESSNAME notendswith "\whale.exe") select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.QUERY,Action1.STATUSCODE,Action1.RESULT