← Labs
NetworkMediumFree
Many Names
Company: Saryarka Telecom JSC
40 min7 questions100 pointsMITRE ATT&CK:T1071.004T1041
Briefing
Saryarka Telecom JSC is a regional telecom operator. The resolver administrator complained that load grew several-fold in one evening although nobody was in the office. The query export was handed to you.
What matters here is not the content of the names but their statistics. An ordinary workstation asks for a dozen familiar names an evening: mail, updates, the portal. Hundreds of different names inside one domain from a single machine is not a person.
The set contains both ordinary and suspicious queries. Separating them is part of the task.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
Frames in the PCAP are truncated at capture to 96 bytes, as on a real perimeter: headers are enough for analysis and the on-wire length is genuine, so volumes in Statistics → Conversations match the table.
360 connections
| Protocol | Details | ||||
|---|---|---|---|---|---|
| 2026-02-18T04:06:47Z | 10.70.4.66:63399 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T04:08:36Z | 10.70.4.108:55959 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T04:16:13Z | 10.70.4.23:57311 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T04:17:56Z | 10.70.4.91:53359 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T04:29:30Z | 10.70.4.38:56047 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T04:40:44Z | 10.70.4.91:62718 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T04:41:01Z | 10.70.4.91:61740 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T04:44:34Z | 10.70.4.38:54964 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T04:48:37Z | 10.70.4.108:58792 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T04:50:11Z | 10.70.4.38:54492 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T04:50:53Z | 10.70.4.14:52626 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T04:52:46Z | 10.70.4.79:56190 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T04:56:34Z | 10.70.4.79:49442 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T04:57:51Z | 10.70.4.79:58805 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T05:04:44Z | 10.70.4.57:63858 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T05:05:30Z | 10.70.4.66:51693 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T05:07:07Z | 10.70.4.66:58498 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T05:19:17Z | 10.70.4.91:54261 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T05:22:56Z | 10.70.4.108:63412 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T05:25:44Z | 10.70.4.57:51216 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T05:27:25Z | 10.70.4.79:58236 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T05:28:07Z | 10.70.4.79:53611 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T05:29:22Z | 10.70.4.38:56394 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T05:34:26Z | 10.70.4.23:65032 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T05:47:59Z | 10.70.4.14:63804 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T05:53:40Z | 10.70.4.66:63797 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T05:57:19Z | 10.70.4.108:62645 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T05:59:17Z | 10.70.4.38:54506 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T06:03:12Z | 10.70.4.23:58657 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T06:13:00Z | 10.70.4.79:56650 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T06:13:27Z | 10.70.4.79:55365 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T06:13:54Z | 10.70.4.57:56763 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T06:18:30Z | 10.70.4.57:62160 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T06:23:21Z | 10.70.4.38:58115 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T06:25:22Z | 10.70.4.79:64003 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T06:28:47Z | 10.70.4.14:62740 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T06:42:09Z | 10.70.4.79:52156 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T06:53:35Z | 10.70.4.38:51486 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T07:02:12Z | 10.70.4.38:49565 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T07:03:09Z | 10.70.4.38:53998 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T07:04:36Z | 10.70.4.14:64725 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T07:24:11Z | 10.70.4.108:65225 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T07:24:38Z | 10.70.4.23:50990 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T07:27:43Z | 10.70.4.23:54291 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T07:35:14Z | 10.70.4.23:65412 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T07:49:40Z | 10.70.4.57:63790 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T08:00:18Z | 10.70.4.108:58461 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T08:01:07Z | 10.70.4.23:64097 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T08:02:20Z | 10.70.4.57:54344 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T08:03:09Z | 10.70.4.23:55098 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T08:04:27Z | 10.70.4.57:58895 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T08:06:20Z | 10.70.4.79:59507 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T08:07:54Z | 10.70.4.14:54496 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T08:09:09Z | 10.70.4.57:61489 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T08:12:27Z | 10.70.4.79:57251 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T08:15:03Z | 10.70.4.14:61612 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T08:15:58Z | 10.70.4.38:55088 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T08:18:00Z | 10.70.4.108:58741 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T08:20:03Z | 10.70.4.57:49907 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T08:25:29Z | 10.70.4.79:51598 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T08:26:00Z | 10.70.4.38:51954 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T08:26:47Z | 10.70.4.14:55542 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T08:29:42Z | 10.70.4.38:50782 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T08:31:00Z | 10.70.4.23:52473 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T08:32:18Z | 10.70.4.91:59192 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T08:33:30Z | 10.70.4.14:57498 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T08:36:01Z | 10.70.4.91:50276 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T08:44:41Z | 10.70.4.38:50072 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T08:52:42Z | 10.70.4.108:62716 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T09:04:46Z | 10.70.4.23:63140 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T09:05:29Z | 10.70.4.79:62439 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T09:12:04Z | 10.70.4.23:64181 | 10.70.4.5:53 | udp/dns | 84 ↑ 27 ↓ | DNS A? update.vendor-cdn.example |
| 2026-02-18T09:13:46Z | 10.70.4.57:49850 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T09:18:22Z | 10.70.4.23:58665 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T09:24:05Z | 10.70.4.23:49908 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T09:26:51Z | 10.70.4.38:54622 | 10.70.4.5:53 | udp/dns | 81 ↑ 27 ↓ | DNS A? meet.video-svc.example |
| 2026-02-18T09:27:57Z | 10.70.4.57:62697 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T09:34:16Z | 10.70.4.108:52357 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
| 2026-02-18T09:41:27Z | 10.70.4.79:65095 | 10.70.4.5:53 | udp/dns | 85 ↑ 27 ↓ | DNS A? portal.corp-portal.example |
| 2026-02-18T09:42:00Z | 10.70.4.14:61977 | 10.70.4.5:53 | udp/dns | 83 ↑ 27 ↓ | DNS A? mail.corp-portal.example |
Questions
0/7 · 0/100 points
Log in to save your progress and appear on the leaderboard.
Which internal address is sending an unusual number of name lookups?
Format: IPv4 address · 10 points
Which domain are those names being requested under?
Format: Domain name without the subdomain · 20 points
How many unique names inside that domain were requested?
Format: Whole number · 20 points
How many queries to that domain are in the set in total?
Format: Whole number · 15 points
When did the first such query go out? UTC.
Format: YYYY-MM-DD HH:MM:SS · 15 points
Which resolver did those queries go to?
Format: IPv4 address · 10 points
Which MITRE ATT&CK technique covers a command channel over DNS?
Format: Identifier like T1234.004 · 10 points