Kung fu has a principle for this kind of thing: the best block is the one where your opponent never actually lands the punch. You see it coming, you’re in position, and by the time it arrives there’s nothing left to hit. Twelve years of teaching that idea to students, and I still get a small, quiet satisfaction every time I watch it happen in a packet capture instead of on a mat.
The alert that started this one was an ET MALWARE signature for a Magecart loader, the kind of skimmer script that sits on a checkout page and quietly copies card numbers as people type them. The host behind it was a personal device on our network, no EDR agent, which means once the alert fires, the investigation runs entirely on network visibility. No process tree, no endpoint telemetry, just what the firewall saw crossing the wire.
The traffic log for that device told a mostly boring story, the kind of boring that’s actually good news. Games, ad SDKs, video, the usual noise a personal phone or laptop generates in the background all day. Buried in that noise, though, were 53 sessions the firewall’s own threat engine had already killed on sight. Most of it turned out to be exactly what you’d expect from that mix, low-grade grayware and ad fraud riding along with legitimate apps. One cluster stood out.
Eight sessions, all to the same address, all inside a ninety second window. Same destination port, same tiny handful of bytes sent, almost nothing received back, seventy four bytes on most of them. That’s not a page loading. That’s barely a knock on the door. A quick reverse lookup on the IP turned up a Shopify hostname behind it, which lined up with the original alert category. Someone, or something, had reached out toward what looked like a storefront’s checkout infrastructure eight times in under two minutes and gotten almost nothing in return.
The detail that mattered most wasn’t the destination. It was what was missing from the connection itself. A real browser loading a real page sends a hostname along with the request, it’s how the server behind a shared address knows which of the thousands of sites it hosts to actually serve. These sessions carried no hostname at all. Just a bare IP, a handshake, and an exit before anything meaningful could come back. That’s not how people browse. That’s how a script talks when it doesn’t care about being convincing, it just wants a payload, and it wants it fast.
It never got one. Every one of those eight attempts ended the same way, killed by signature before any real data crossed. I went back through the sandbox submission logs for the device covering the prior month looking for anything that had actually been delivered and analyzed. Nothing. No payload, no file, no artifact, because nothing ever arrived to become one.
I think about that gap a lot, the space between an attempt and a landed hit. It’s easy to treat every alert as though the worst case already happened and just work backward from there. Most of the job is actually the opposite: figuring out how much of the worst case got stopped before it started, and being honest with yourself about the difference. Eight attempts, zero bytes worth calling a success, zero sandbox hits. That’s not a maybe. That’s a block that held.
The device still went out for a local scan, because network visibility can only ever tell you what crossed the wire, not what’s sitting on the disk. But the network did its job here. The punch never landed, and for once I got to watch it happen from a log file instead of a mat.
This writeup describes an incident at a large institution. All internal IPs have been substituted with RFC 1918 ranges and identifying details have been generalized.