A. The four hosts are 18.104.22.168, 22.214.171.124, 126.96.36.199 and 188.8.131.52, which are the name servers for doubleclick.net, although you might see other addresses. The event description is:
The DNS server encountered an invalid domain name in a packet from
You might find the clients trying to contact various other servers, such as buy.rpts.net, ad.doubleclick.net, and ebay.doubleclick.net. The error is caused by the DNS cache-pollution protection not accepting resolutions from nonauthoritative servers. (See the Microsoft article "Description of the DNS Server Secure Cache Against Pollution setting," http://support.microsoft.com/?kbid=316786 for more information). You could consider blocking doubleclick.net at the firewall or monitor the traffic at a firewall level to ascertain which machines on your network are originating the requests.