Interval

by fg0x0 Forensics A registered counterpart on the Commons mesh started talking to peers that are not on the register. We captured a little over a minute before the flows were cut.

The vendor says it is a pairing keepalive, and our own analysts agree with them, which is what worries us. Every beacon carries the same query type to the same domain. The only thing that changes is a counter that goes up by one, forever. There is no payload, no encoding, nothing to decode. Somebody already chased the base64 blob in the HTTP session; it is a taunt.

The message left the Commons anyway, and not one of the flows carries enough of it to matter on its own.

Two agents agreed on something without saying it out loud. Find out what.