Periodic outbound connections from office workstation

IT administrator A. Desai (synthetic) of Kestrel Logistics (synthetic), SG Highway, Ahmedabad reports suspicious network activity first noticed on 12 September 2026. The firewall shows workstation 10.0.4.17 connecting to 203.0.113.45 every 60 seconds outside office hours. DNS queries were made to update-cdn.example.net, a domain the company does not use. A packet capture from the office gateway (office-gw-0912.pcapng) is attached. No ransom note or data loss has been confirmed.

• Investigation Intelligence

  Every case starts from the complaint: entities, timeline, summary and related cases are drawn from its text.

• Cyber / Network Forensics

  A packet capture is attached. Network review is relevant; complaint content and capture availability are independent signals.

Category

Cyberattack / intrusion

Location

SG Highway, Ahmedabad

Incident time

13 Sept 2026, 03:30

Context

—

Created

13 Sept 2026, 10:40

Updated

14 Oct 2026, 17:30

Nothing flagged by demo rules.

1. Case created from synthetic sample

   13 Sept 2026, 10:40