Sometimes in some network captures that include my DNS server, I find there are failed lookups for what seem like invalid requests.
When viewed in Wireshark these show up with what looks like escaped bytes outside the ASCII range.
An example from Wireshark's query.name > Copy > Bytes > Hex Stream is:
Raw: 03777777128b68481cc5116ceb53bade651327d982751903636f6d00`
As Python bytes: \x03www\x12\x8bhH\x1c\xc5\x11l\xebS\xba\xdee\x13'\xd9\x82u\x19\x03com\x00
You can see there's part of the usual DNS query format there:
- Signal for 3 bytes, then
www
- Signal for 18 bytes, then... gibberish.
- Signal for 3 bytes, then
com
I can't figure out what the middle bit is supposed to be.
I'm familiar with Punycode for international characters, and I'm reasonably sure that's not what this is.
I don't have access to the hosts that are making the requests. I know some malware tries to resolve things like this, so I'm curious about whether this might indicate the presence of malware.
Edited to add:
Here is a screenshot of the DNS response, as seen by Wireshark: