Ah, it wasn't blocked directly, but rather as a CNAME.
(That would mean the domain that was blocked tried to hide the fact that it would indeed be g.msn.com by using CNAME cloaking)
But that is just one hit, or did you limit your output to show just one entry?