diff --git a/backend/src/ee/services/audit-log-stream/audit-log-stream-fns.ts b/backend/src/ee/services/audit-log-stream/audit-log-stream-fns.ts
index cce8f2a58..3b0eb412b 100644
--- a/backend/src/ee/services/audit-log-stream/audit-log-stream-fns.ts
+++ b/backend/src/ee/services/audit-log-stream/audit-log-stream-fns.ts
@@ -1,8 +1,20 @@
+// Specific DataDog log intake hostnames
+const dataDogHostnames = [
+  "http-intake.logs.datadoghq.com",
+  "http-intake.logs.us3.datadoghq.com",
+  "http-intake.logs.us5.datadoghq.com",
+  "http-intake.logs.datadoghq.eu",
+  "http-intake.logs.ap1.datadoghq.com",
+  "http-intake.logs.ddog-gov.com"
+];
+
 export function providerSpecificPayload(url: string) {
   const payload: Record<string, string> = {};
 
-  // If URL is related to DataDog, add a "ddsource: infisical" entry
-  if (url.includes("datadoghq")) {
+  // If URL is for DataDog, add a "ddsource: infisical" entry
+  if (
+    dataDogHostnames.some((hostname) => url.startsWith(`https://${hostname}`) || url.startsWith(`http://${hostname}`))
+  ) {
     payload.ddsource = "infisical";
   }