FCP-FSA-AD-5-0: Fortinet NSE 5 - FortiSandbox 5.0 Administrator

In the PCAP trace, the host name being requested (a public domain) is repeatedly resolved to a private RFC1918 address (192.168.250.1), and the HTTP GET requests successfully complete against that private address. This behavior—consistent, successful resolution of an external domain to an internal address—is characteristic of the sandbox VM environment using a private (internal) DNS server for name resolution instead of a proper public DNS server. If there were no route to the internet or no internet access on the outgoing sandbox interface (port3), the connections would fail or time out rather than resolve and complete against a private address. The scan profile setting for executable files only controls whether such files are analyzed, not what IP address a URL host resolves to.