Investigate shows a domain with extremely low popularity that almost no other networks query, yet DNS logs show one internal host resolving it every 60 seconds around the clock, including when no user is logged in. What does this pattern most likely indicate?
Select an answer to reveal the explanation.
Short Explanation
You don't check a website every 60 seconds at 3 a.m. with nobody logged in, but malware phoning home does. A domain almost nobody else on the internet uses, hit on a metronome schedule, is a classic beacon. The trap is assuming frequent means trusted; frequency is the red flag here.
Full Explanation
Popularity in Investigate reflects how widely a domain is queried across the global resolver population. An extremely unpopular domain is one that almost no one resolves. When a single internal host resolves such a domain at a fixed interval continuously, including when no user is present, the regularity points to software rather than a person, and the obscurity points away from mainstream services. Malware commonly beacons to its command-and-control server on a timer to receive instructions, which matches this pattern closely. Legitimate update checkers belong to vendors whose domains are queried by very large numbers of systems, so they would not show extremely low popularity, and frequent queries never establish trust. Browsing by a user is irregular and stops when the user logs off. A resolver caching problem would affect many clients and many names, not one host and one obscure domain at a steady interval. Exam caveat: some beacons add random jitter to avoid fixed intervals, so look for persistent regularity rather than exact timing. Operational check: block the domain, confirm through DNS logs that the queries continue to be blocked, and examine the host with the EDR tool to find the process making the requests.