Sandbox host DNS lookup followed by outbound connection to same external domain

ills3c Intel&Coffee@Ills3C

•updated today•0•0•1

Detects sandbox or training hosts performing DNS resolution followed shortly by outbound connections to public IP addresses on ports 80 or 443, which may indicate a firewall misconfiguration or unauthorized egress from isolated environments.