DNS Query to External Service Interaction Domains

Description

Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security researchers and attackers alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and Log4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain.

A detection indicates that a host on your network resolved one of these domains, which may mean: (1) an attacker is actively probing or exploiting a vulnerable service and using the callback to confirm code execution or data exfiltration, (2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets.

Investigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session), and any concurrent outbound connections or process activity to determine intent.

Query · sigma

selection:
  query|endswith:
  - .burpcollaborator.net
  - .canarytokens.com
  - .ceye.io
  - .ddns.1443.eu.org
  - .ddns.bypass.eu.org
  - .ddns.xn--gg8h.eu.org
  - .digimg.store
  - .dns.su18.org
  - .dnshook.site
  - .dnslog.cn
  - .dnslog.ink
  - .gobygo.net
  - .instances.httpworkbench.com
  - .interact.sh
  - .log.dnslog.pp.ua
  - .log.dnslog.qzz.io
  - .log.dnslogs.dpdns.org
  - .log.javaweb.org
  - .log.nat.cloudns.ph
  - .oast.fun
  - .oast.live
  - .oast.me
  - .oast.online
  - .oast.pro
  - .oast.site
  - .oastify.com
  - .p8.lol
  - .requestbin.net
filter_main_polling:
  query|contains: polling.oastify.com
condition: selection and not 1 of filter_main_*

Known false positives

  • Legitimate security scanning.
Raw source DNS Query to External Service Interaction Domains · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: DNS Query to External Service Interaction Domains
id: aff715fa-4dd5-497a-8db3-910bea555566
status: test
description: |
    Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains.
    These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security
    researchers and attackers alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and
    Log4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain.

    A detection indicates that a host on your network resolved one of these domains, which may mean:
        (1) an attacker is actively probing or exploiting a vulnerable service and using the callback to
        confirm code execution or data exfiltration,
        (2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets.

    Investigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session),
    and any concurrent outbound connections or process activity to determine intent.
references:
    - https://twitter.com/breakersall/status/1533493587828260866
    - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287
    - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234
    - https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve
author: Florian Roth (Nextron Systems), Matt Kelly (list of domains)
date: 2022-06-07
modified: 2026-07-23
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
logsource:
    category: dns
detection:
    selection:
        query|endswith:
            - '.burpcollaborator.net' # Portswigger Burpsuite Collaborator
            - '.canarytokens.com' # Thinkst Canary Canarytokens
            - '.ceye.io'
            - '.ddns.1443.eu.org' # dig.pm
            - '.ddns.bypass.eu.org' # dig.pm
            - '.ddns.xn--gg8h.eu.org' # dig.pm
            - '.digimg.store' # dnslog.ink
            - '.dns.su18.org' # javaweb.org
            - '.dnshook.site' # webhook.site
            - '.dnslog.cn'
            - '.dnslog.ink' # dnslog.ink
            - '.gobygo.net' # gobies.org
            - '.instances.httpworkbench.com' # httpworkbench.com
            - '.interact.sh' # Project Discovery Interactsh
            - '.log.dnslog.pp.ua' # dnslog.org
            - '.log.dnslog.qzz.io' # dnslog.org
            - '.log.dnslogs.dpdns.org' # dnslog.org
            - '.log.javaweb.org' # javaweb.org
            - '.log.nat.cloudns.ph' # dnslog.org
            - '.oast.fun' # Project Discovery Interactsh
            - '.oast.live' # Project Discovery Interactsh
            - '.oast.me' # Project Discovery Interactsh
            - '.oast.online' # Project Discovery Interactsh
            - '.oast.pro' # Project Discovery Interactsh
            - '.oast.site' # Project Discovery Interactsh
            - '.oastify.com' # Portswigger Burpsuite Collaborator
            - '.p8.lol' # javaweb.org
            - '.requestbin.net'
    filter_main_polling:
        query|contains: 'polling.oastify.com'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate security scanning.
level: high

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.