DNS Query to Wildcard DNS Services - Windows

Title: DNS Query to Wildcard DNS Services - Windows
Status: experimental
Description:Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
References:
  -https://nip.io/
  -https://sslip.io/
  -https://traefik.me/
  -https://github.polettix.it/ETOOBUSY/2022/10/09/nip-io-sslip-io/
Author: MahirAli Khan, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-11-05
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1071.004'
• -'attack.t1568'

Logsource:

• product: windows
• category: dns_query

Detection:
  selection:
    QueryName|endswith:
      -'.1u.ms'
      -'.backname.io'
      -'.nip.io'
      -'.sslip.io'
      -'.traefik.me'
      -'.xip.io'

  condition:selection
Falsepositives:
  -Developers on Windows workstations testing local services or web applications without editing the hosts file
Level: medium