Windows DNS Queries to Public Wildcard IP-Encoding Domains

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
- T1568Dynamic Resolution
Exfiltration
Impact

What it detects

This rule matches Windows DNS queries whose query name ends with specific wildcard domains that encode an IP address in the subdomain. Attackers can use these public services to resolve arbitrary hostnames to chosen IPs, enabling infrastructure and potential C2 or phishing staging without registering a dedicated domain. It relies on Windows DNS query telemetry, specifically the QueryName suffix in DNS resolution events.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Network DNS Queries to IP-Embedding Wildcard DNS Services

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Suspicious OAST Callback DNS Query From Next.js Workload

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400

Suspicious DNS C2 to Microsoft Typosquat Domain

Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure

Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure

Suspicious OpenMetadata Exploit Interactsh OAST Callback (via process_creation)

Windows DNS Queries to Public Wildcard IP-Encoding Domains

Pivot detection · T1071.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-queries-to-public-wildcard-ip-encoding-domains-4f8a1c2e

title: Windows DNS Queries to Public Wildcard IP-Encoding Domains
id: 87ffa678-a7bb-475b-962a-f78f57148a80
related:
  - id: 139ddcb3-ba90-4407-b0b1-1838131ce8e7
    type: similar
  - id: 4f8a1c2e-7d3b-4e5f-9a6c-0b1d2e3f4a5b
    type: derived
status: experimental
description: This rule matches Windows DNS queries whose query name ends with specific wildcard domains that encode an IP address in the subdomain. Attackers can use these public services to resolve arbitrary hostnames to chosen IPs, enabling infrastructure and potential C2 or phishing staging without registering a dedicated domain. It relies on Windows DNS query telemetry, specifically the QueryName suffix in DNS resolution events.
references:
  - https://nip.io/
  - https://sslip.io/
  - https://traefik.me/
  - https://github.polettix.it/ETOOBUSY/2022/10/09/nip-io-sslip-io/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_wildcard_dns_service.yml
author: MahirAli Khan, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-11-05
tags:
  - attack.command-and-control
  - attack.t1071.004
  - attack.t1568
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|endswith:
      - .1u.ms
      - .backname.io
      - .nip.io
      - .sslip.io
      - .traefik.me
      - .xip.io
  condition: selection
falsepositives:
  - Developers on Windows workstations testing local services or web applications without editing the hosts file
level: medium
regression_tests_path: regression_data/rules/windows/dns_query/dns_query_win_wildcard_dns_service/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL