Log file shows Firefox activity: is this normal?

[Rubi1200]

I see these activities logged on a fairly regular basis in /var/log/auth.log and was wondering if this is normal activity?

firefox: gethostby*.getanswer: asked for "ftp.cs.rose-hulman.edu IN A", got type "DNAME"

The format is always the same, though sometimes the address is a regular Internet site.

Any insights?

Thanks in advance.

[Soul-Sing]

please install htop, or run top in the terminal and show the results here.
could be an add-on phoning home for some reason?

[Rubi1200]

Here is the output from htop; not sure if there is anything there.
Thanks.

[Rubi1200]

This kind of activity is also being logged:

firefox: gethostby*.getanswer: asked for "www.unixtutorials.info.nyud.net IN A", got type "DNAME"

There doesn't seem to be any pattern to these messages. Sometimes they will appear in /var/log/auth.log a couple of times in one day, sometimes not for a few days, and then, as above, a different address is shown but always with the format shown here.

Additional information if it helps; no vnc, ssh, or remote desktop. Only cups as a listening service. Default Firefox installation with NoScript.
That's it; happy to provide more info if needed.
Thanks.

[Soul-Sing]

Do you have any connection with/to Rose-Human Institute of Technology? via putty or ftp?

[Rubi1200]

None whatsoever. The only thing I can think of is that it may have been a link for downloading an ISO image. But, the message keeps re-appearing in the log even though I downloaded the image 2 days ago.
I have cleared the cache in Firefox, so I don't think that could be it.

[Rubi1200]

Update:

I ran tail -F /var/log/auth.log and then went to a few of my regular sites. The message (firefox: gethostby*.getanswer: asked for "ftp.cs.rose-hulman.edu IN A", got type "DNAME") appeared in the log when I went to www.distrowatch.com

This is a bit unusual?

[cdenley]

It looks like firefox is attempting to resolve those domains, but receives an incorrect response from your DNS server. Firefox can sometimes resolve domains which you haven't used.
https://developer.mozilla.org/en/Con...NS_prefetching

You can try changing DNS servers to see if the problem goes away.

Google:
8.8.8.8
8.8.4.4

OpenDNS:
208.67.222.222
208.67.220.220

[Rubi1200]

Ok, that makes sense.

Can I assume this is not a serious security concern?

Thanks!

[cdenley]

Can I assume this is not a serious security concern?

Well I would be suspicious about any invalid DNS response. It may be the result of DNS spoofing or something. More likely, though, you're just using a poorly run DNS server.