Thought I found DNS tunneling and but after a closer look it seems a bit more complex. Anyone seen this traffic before?
User starts their computer, launches firefox.exe, then they hit c.msn.com within the next second:
DNS Request Sample (171 total)
- c-3sux78kvnkay76x24vx2egjyesvzuzoix2eius.g01.msn.com
- c-3sux78kvnkay76x24masx2eix78ozkux2eius.g01.msn.com
- c-3sux78kvnkay76x24cccx2erotqkjotx2eius.g01.msn.com
- c-3sux78kvnkay76x24vdx2egjyx2erotqkjotx2eius.g01.msn.com
- c-3sux78kvnkay76x24ijtpyx2eiruajlrgx78kx2eius.g01.msn.com
- c-3sux78kvnkay76x24cccx2emuumrkzgmykx78boikyx2eius.g01.msn.com
- c-3sux78kvnkay76x24iutzkdzagrx2eskjogx2etkz.g01.msn.com
- c-3sux78kvnkay76x24cojmkzyx2ezx78kkx2eius.g01.msn.com
- c-3sux78kvnkay76x24sytx2eruiqkx78juskx2eius.g01.msn.com
- c-msn-com-nsatc.trafficmanager.net
Connections to many major CDNs (51) Amazon, Fastly, Highwinds, AOL, Verizon, etc
Reading up on trafficmanager.net, it seems to point to an Azure traffic manager owned by MS. https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1809-non-enterprise-editions
The URLs do not fit the bill for DNS tunneling as none of the URLs are unique to the internet: Last Updated 5 years ago https://www.virustotal.com/gui/domain/c-3sux78kvnkay76x24sytx2eruiqkx78juskx2eius.g01.msn.com/details
CDN connections could be explained by Windows or Firefox updates, but I am still perplexed by 171 DNS requests. The only thing written to file was into firefox's prefs-1.js.