named: lame server (high numbers)
named[28334]: lame server resolving 'www.wombband.com' (in 'wombband.com'?): xxx.xxx.xxx.xxx#53
named[28334]: lame server resolving 'www.wombband.com' (in 'wombband.com'?): xxx.xxx.xxx.xxx#53
Normally I wouldn't be worried, but we started getting those yesterday, by now we have about 100000 requests (2/sec for each nameserver). They target one of our reseller (both his nameservers), the IPs at the end of the line are his nameserver IPs. We do not host wombband - never have. Wombband appears to be virus related traffic.
Any idea how to fix this? Or should we just stop logging?
