strange query

[Bill Manning]

% 
% Could this be an attack, or is something like that considered normal
% (never saw it bevore).
% 
% Aug 23 13:04:12 box named[7349]: bad referral (253.243.225.193.in-addr.arpa !< 25\003193\007in-addr\004arpa\000\000\012\000\001\192\021\000\002\000\001\000\001Ix\000\019\009blackhole\003isi.edu)
% Aug 23 13:04:14 box named[7349]: bad referral (253.243.225.193.in-addr.arpa !< 25\003193\007in-addr\004arpa\000\000\012\000\001\192\021\000\002\000\001\000\001Iv\000\019\009blackhole\003isi.edu)
% 
% This box runs bind 8.2.2-p5
% 

	Perhaps. Blackhole.isi.edu is an authorized server in the
	Internet for RFC 1918 space. It acts to help folks identify
	leaks in their firewalls. In this case, it appears blackhole
	received a query for private network space and is attempting
	to respond. You likely have a misconfigured firewall.

-- 
--bill