DNS Query to External Service Interaction Domains

calendar Jul 27, 2026 · attack.initial-access attack.t1190 attack.reconnaissance attack.t1595.002  ·
Share on: linkedin copy

Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security researchers and attackers alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and Log4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain.

A detection indicates that a host on your network resolved one of these domains, which may mean: (1) an attacker is actively probing or exploiting a vulnerable service and using the callback to confirm code execution or data exfiltration, (2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets.

Investigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session), and any concurrent outbound connections or process activity to determine intent.

Sigma rule (View on GitHub)

 1title: DNS Query to External Service Interaction Domains
 2id: aff715fa-4dd5-497a-8db3-910bea555566
 3status: test
 4description: |
 5    Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains.
 6    These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security
 7    researchers and attackers alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and
 8    Log4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain.
 9
10    A detection indicates that a host on your network resolved one of these domains, which may mean:
11        (1) an attacker is actively probing or exploiting a vulnerable service and using the callback to
12        confirm code execution or data exfiltration,
13        (2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets.
14
15    Investigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session),
16    and any concurrent outbound connections or process activity to determine intent.    
17references:
18    - https://twitter.com/breakersall/status/1533493587828260866
19    - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287
20    - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234
21    - https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve
22author: Florian Roth (Nextron Systems), Matt Kelly (list of domains)
23date: 2022-06-07
24modified: 2026-07-23
25tags:
26    - attack.initial-access
27    - attack.t1190
28    - attack.reconnaissance
29    - attack.t1595.002
30logsource:
31    category: dns
32detection:
33    selection:
34        query|endswith:
35            - '.burpcollaborator.net' # Portswigger Burpsuite Collaborator
36            - '.canarytokens.com' # Thinkst Canary Canarytokens
37            - '.ceye.io'
38            - '.ddns.1443.eu.org' # dig.pm
39            - '.ddns.bypass.eu.org' # dig.pm
40            - '.ddns.xn--gg8h.eu.org' # dig.pm
41            - '.digimg.store' # dnslog.ink
42            - '.dns.su18.org' # javaweb.org
43            - '.dnshook.site' # webhook.site
44            - '.dnslog.cn'
45            - '.dnslog.ink' # dnslog.ink
46            - '.gobygo.net' # gobies.org
47            - '.instances.httpworkbench.com' # httpworkbench.com
48            - '.interact.sh' # Project Discovery Interactsh
49            - '.log.dnslog.pp.ua' # dnslog.org
50            - '.log.dnslog.qzz.io' # dnslog.org
51            - '.log.dnslogs.dpdns.org' # dnslog.org
52            - '.log.javaweb.org' # javaweb.org
53            - '.log.nat.cloudns.ph' # dnslog.org
54            - '.oast.fun' # Project Discovery Interactsh
55            - '.oast.live' # Project Discovery Interactsh
56            - '.oast.me' # Project Discovery Interactsh
57            - '.oast.online' # Project Discovery Interactsh
58            - '.oast.pro' # Project Discovery Interactsh
59            - '.oast.site' # Project Discovery Interactsh
60            - '.oastify.com' # Portswigger Burpsuite Collaborator
61            - '.p8.lol' # javaweb.org
62            - '.requestbin.net'
63    filter_main_polling:
64        query|contains: 'polling.oastify.com'
65    condition: selection and not 1 of filter_main_*
66falsepositives:
67    - Legitimate security scanning.
68level: high

References

Related rules

to-top