DNS Query to Wildcard DNS Services - Network

Title: DNS Query to Wildcard DNS Services - Network
Status: experimental
Description:Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
References:
  -https://nip.io/
  -https://sslip.io/
  -https://traefik.me/
  -https://github.polettix.it/ETOOBUSY/2022/10/09/nip-io-sslip-io/
Author: MahirAli Khan
Date: 2026-11-05
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1071.004'
• -'attack.t1568'

Logsource:

• category: dns

Detection:
  selection:
    query|endswith:
      -'.1u.ms'
      -'.backname.io'
      -'.nip.io'
      -'.sslip.io'
      -'.traefik.me'
      -'.xip.io'

  condition:selection
Falsepositives:
  -Developers using nip.io or sslip.io to test local HTTPS setups or Kubernetes ingress rules without modifying /etc/hosts
  -CI/CD pipelines that provision ephemeral review environments with dynamically generated hostnames (e.g. PR-based preview deployments)
Level: medium