This network-based rule flags DNS queries that target public wildcard DNS services which embed an IP address in the hostname. The detection looks for queries ending with known wildcard service suffixes such as .nip.io, .sslip.io, .xip.io, .backname.io, .traefik.me, and .1u.ms. Adversaries leverage these services to create quickly deployable C2 channels or staging infrastructure without registering a dedicated domain, aiding evasion and attribution challenges. By monitoring DNS query names for these suffixes, the rule helps surface beaconing or infrastructure setup patterns commonly associated with command-and-control or phishing infrastructure that relies on dynamic IP resolution via subdomains. The rule aligns with DNS-based detection (T1071.004) and broader C2/adversary infrastructure tactics (T1568). As an experimental rule, it includes documented false positives from legitimate testing and ephemeral environments (e.g., developers or CI/CD preview deployments using wildcard domains). The rule uses a straightforward ends-with condition on the DNS query field to trigger detections and is best complemented with monitoring of related DNS patterns and correlation across time, source IPs, and target services to reduce drift from legitimate usage.