Recover the Web Ring

3.1 Naughty IP

Use the artifacts https://storage.googleapis.com/hhc22_player_assets/boriaArtifacts.zip from Alabaster Snowball to analyze this attack on the Boria mines. Most of the traffic to this site is nice, but one IP address is being naughty! Which is it? Visit Sparkle Redberry in the Tolkien Ring for hints.

Hint(s)

Solve

ANSWER: 18.222.86.32

Terminal answers

Filter: ip.src==18.222.86.32 && ip.dst==10.12.42.16
Observe the top talker HTTP IP addresses 18.222.86.32