Detectionmediumexperimental
DNS Query to Wildcard DNS Services - Network
Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
Log Source
dns
Categorydns← raw: dns
Detection Logic
Detection Logic1 selector
detection:
selection:
query|endswith:
# IP-embedding services (subdomain encodes an arbitrary IP)
- '.1u.ms'
- '.backname.io'
- '.nip.io'
- '.sslip.io'
- '.traefik.me'
- '.xip.io'
condition: selectionFalse Positives
Developers using nip.io or sslip.io to test local HTTPS setups or Kubernetes ingress rules without modifying /etc/hosts
CI/CD pipelines that provision ephemeral review environments with dynamically generated hostnames (e.g. PR-based preview deployments)
MITRE ATT&CK
Tactics
Techniques
Sub-techniques
Rule Metadata
Rule ID
139ddcb3-ba90-4407-b0b1-1838131ce8e7
Status
experimental
Level
medium
Type
Detection
Created
2026-11-05
Author
Path
rules/network/dns/net_dns_wildcard_dns_service.yml
Raw Tags
attack.command-and-controlattack.t1071.004attack.t1568