DNS Tunnel or Not (g01.msn.com)

Question

Thought I found DNS tunneling and but after a closer look it seems a bit more complex. Anyone seen this traffic before?

User starts their computer, launches firefox.exe, then they hit c.msn.com within the next second:

DNS Request Sample (171 total)

• c-3sux78kvnkay76x24vx2egjyesvzuzoix2eius.g01.msn.com
• c-3sux78kvnkay76x24masx2eix78ozkux2eius.g01.msn.com
• c-3sux78kvnkay76x24cccx2erotqkjotx2eius.g01.msn.com
• c-3sux78kvnkay76x24vdx2egjyx2erotqkjotx2eius.g01.msn.com
• c-3sux78kvnkay76x24ijtpyx2eiruajlrgx78kx2eius.g01.msn.com
• c-3sux78kvnkay76x24cccx2emuumrkzgmykx78boikyx2eius.g01.msn.com
• c-3sux78kvnkay76x24iutzkdzagrx2eskjogx2etkz.g01.msn.com
• c-3sux78kvnkay76x24cojmkzyx2ezx78kkx2eius.g01.msn.com
• c-3sux78kvnkay76x24sytx2eruiqkx78juskx2eius.g01.msn.com
• c-msn-com-nsatc.trafficmanager.net

Connections to many major CDNs (51) Amazon, Fastly, Highwinds, AOL, Verizon, etc

Reading up on trafficmanager.net, it seems to point to an Azure traffic manager owned by MS. https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1809-non-enterprise-editions

The URLs do not fit the bill for DNS tunneling as none of the URLs are unique to the internet: Last Updated 5 years ago https://www.virustotal.com/gui/domain/c-3sux78kvnkay76x24sytx2eruiqkx78juskx2eius.g01.msn.com/details

CDN connections could be explained by Windows or Firefox updates, but I am still perplexed by 171 DNS requests. The only thing written to file was into firefox's prefs-1.js.

Answer 1

Nothing here indicates for me a DNS tunnel and all the arguments you present yourself are against this too. The kind of URLs you see are not untypical for CDN or advertisement networks.

Note that *.msn.com is specifically documented in the document you link to as "Windows Spotlight related traffic" and Windows Spotlight is according to Wikipedia "...a feature included by default in Windows 10 that downloads pictures and advertisements automatically from Bing and displays them when the lock screen is being shown on a computer running Windows 10.".

This pretty much explains for me why you see pattern similar to CDN and advertisement networks here. And the trigger for this traffic is likely not the start of Firefox but the start of your computer, i.e. I expect it to happen even without Firefox getting started.