Questions[china](server)

my BIND 9.10.3 is logging strange entries like:

Jan 12 12:44:49 www named[24776]: client 117.136.25.126#18977: message parsing failed: FORMERR
Jan 12 12:50:47 www named[24776]: client 117.136.25.126#18978: message parsing failed: FORMERR
Jan 12 13:00:08 www named[24776]: client 117.136.95.15#24805: message parsing failed: FORMERR

117.136.95.15 is not in my network, and I don't allow recursion for anything but localhost, thus it must be for a zone I'm authoritative for.

This only started recently (Jan 5th). Looking at the log it seems, that only queries from:

# zfgrep "message parsing failed: FORMERR" daemon.log*  | awk '{print $7}' |awk -F\. '{printf("%s.%s.x.x\n",$1,$2)}'  | sort | uniq -c | sort -n 
  1 101.27.x.x
  1 121.31.x.x
  1 1.84.x.x
  1 61.158.x.x
104 223.104.x.x
150 117.136.x.x

are causing this. Looking at the WHOIS info for those IPs:

inetnum:        117.128.0.0 - 117.191.255.255
netname:        CMNET
descr:          China Mobile Communications Corporation
descr:          Mobile Communications Network Operator in China
descr:          Internet Service Provider in China
country:        CN

inetnum:        223.64.0.0 - 223.117.255.255
netname:        CMNET
descr:          China Mobile Communications Corporation
descr:          Mobile Communications Network Operator in China
descr:          Internet Service Provider in China
country:        CN

Our servers are in London, UK on rackspace cloud. We have most resources on the rackspace CDN which improves speeds to most countries around the world. We are now selling our product in China.

I will have up to 500,000 Chinese school children using our website.

Do I need a dedicated server in China?

Do I need any special configuration to serve a website to China from the UK?

I have a web site that uses a couple hundred domain aliases, including franchise-dallas.info, franchise-delaware.info, and detroitfranchise.info (see more below).

I have been getting ten to twenty hits per day via Google AdWords PPC. I set up a log file so that I could see the variables in the URL.

I was surprised to see that the page is getting hit about once per minute. I looked up the IPs and they are all in China.

My site has ZERO content that would be of use to anyone outside the U.S.A.

Can you tell me why my site would be getting this type of hit? Is this normal? Is this a bot?

TIME, IP, DOMAIN, PAGE
20:9, 66.249.71.138, franchise-st-petersburg.info, Why-Buy-a-Franchise
20:13, 66.249.71.21, franchise-ok.info, Frequently-Asked-Questions-About-Franchises
20:16, 66.249.71.44, franchise-dallas.info, Frequently-Asked-Questions-About-Franchises
20:20, 66.249.71.36, franchise-delaware.info, Frequently-Asked-Questions-About-Franchises
20:21, 66.249.71.136, detroitfranchise.info, What-We-Do-Free-Franchise-Advice
20:21, 66.249.71.10, philadelphiafranchise.info, Privacy-Policy
20:21, 66.249.71.144, denverfranchise.info, Franchise-Terminology
20:22, 66.249.71.59, franchise-tx.info, Get-Started-Ask-a-Franchise-Expert
20:24, 67.195.114.240, franchise-ky.info, Franchise-Terminology
20:27, 66.249.71.138, franchise-st-petersburg.info, Why-Buy-a-Franchise

Someoen from china with two different ip is downloading the same big file from my server. Their ip are:

• 122.89.45.210
• 60.210.7.62

They requesting this file and downloading more than 20 times per minute.

What Can I do to prevent this? (I am on gentoo with root access)

And WHY they do this to a site that doesn't have nothing to do with china ?

ADD1:

Other ips:

• 221.8.60.131
• 124.67.47.56
• 119.249.179.139
• 60.9.0.176

ADD2:

the stupid thing is they are requesting only 1 single file lol. Or they want that file removed (tho i don't see why) Or they are pretty stupid

ADD3:

Situation is getting worse. IP are spreading from other countries too (usa and korea if www.geobytes.com/iplocator.htm it's right) And now they are requesting another file.

ADD4:

it seems after they realized i removed that file they stopped attacking me. I will monitor the situation.

They started again after a sleep of 3-4 mintues with the same file (lucky me). Hard to say why this is happening

Are there any hosting companies specialized in serving both European, N+S American and Chinese, Indian, Korean or Japanese users?

I am looking for a dedicated or VPS to host a Drupal site, not a CDN.

Thanks.