A burst of names that do not exist
A workstation asked for dozens of random domains in a few minutes and almost all failed. Find it, count the failures, and find the one name that answered.
Briefing
Some malware does not hard-code its server. It generates many domain names from the date and tries them until one resolves. That pattern is called a domain generation algorithm, or DGA.
The resolver exports a tab-separated log to /var/log/dns/queries.tsv with the columns ts, client, query, qtype, rcode, and answer. The one generated name that resolves is the name the operator registered.
resolver-02 · DNS investigation
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.