Lame server entries

This may be nothing but I was looking over my /var/log/messages file and noticed the below
entry appearing hundreds of times just in the past 6 hours. I know the 'lame server' message is somewhat normal, but is it normal for that same entry (and IP address) to appear so much? Or could it be some type of attack. The IP addresses
appear to be directly from Microsoft, which seems a little strange.

Apr 5 00:04:27 mercury named[405]: Lame server on 'htomail.com' (in 'htomail.com'?):
[207.46.138.11].53 'DNS4.CP.MSFT.NET'

Apr 5 00:04:27 mercury named[405]: Lame server on 'htomail.com' (in 'htomail.com'?):
[207.46.138.12].53 'DNS5.CP.MSFT.NET'

Apr 5 00:04:27 mercury named[405]: Lame server on 'hotamil.com' (in 'hotamil.com'?):
[207.46.138.12].53 'DNS5.CP.MSFT.NET'

Apr 5 00:04:27 mercury named[405]: Lame server on 'hotamil.com' (in 'hotamil.com'?):
[207.46.138.11].53 'DNS5.CP.MSFT.NET'

 

 

 

 

Top