While idly reviewing event logs I saw something new (to me) this morning.

```
Event Type: Information
Event Source:   DNS
Event Category: None
Event ID:   5504
Date:       9/8/2009
Time:       8:38:09 AM
User:       N/A
Computer:   MYSERVER
Description:
The DNS server encountered an invalid domain name in a packet from 72.233.33.107. The packet will be rejected. The event data contains the DNS packet.

```

I got a few mentioning that .107 address and several more for .109 as well. All within about a 5 second span of time. The event data isn't all that helpful (or is it?):

```
Data:
0000: 97 5b 80 05 00 00 00 00   [.....
0008: 00 00 00 00               ....    

```

Now I'm curious... how could my *internal* AD domain server be getting packets from those ***external*** address(es)?