How to prevent these malicious requests with nginx config? - django

Question

My nginx server (using django) is getting hit with thousands of these types of requests per second:
199.127.61.178 - - [09/Nov/2022:08:20:42 +0000] "GET http://www.wuqiaoxianzajituan.com/ HTTP/1.1" 500 186 "http://www.wuqiaoxianzajituan.com" "Mozilla/5.0 (Linux; U; Android 2.3.5; en-in; Micromax A87 Build/GINGERBREAD) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
104.238.222.87 - - [09/Nov/2022:08:20:42 +0000] "GET http://www.wuqiaoxianzajituan.com/ HTTP/1.1" 400 55440 "http://www.wuqiaoxianzajituan.com" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G950F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36"
172.93.110.55 - - [09/Nov/2022:08:20:42 +0000] "GET http://tucgd.lixil-kitchen.cn/ HTTP/1.1" 400 55373 "http://tucgd.lixil-kitchen.cn" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/537.86.4"
104.243.37.94 - - [09/Nov/2022:08:20:42 +0000] "GET http://you.br-sx.com/ HTTP/1.1" 400 55205 "http://you.br-sx.com" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_2 like Mac OS X) AppleWebKit/604.4.7 (KHTML, like Gecko) Version/11.0 Mobile/15C114 Safari/604.1"
104.238.222.9 - - [09/Nov/2022:08:20:42 +0000] "GET https://skype.gmw.cn/?nf91C2a99VqP4D43fy6uPrgt0 HTTP/1.1" 400 55722 "https://skype.gmw.cn" "Mozilla/5.0 (iPad; U; CPU OS 4_3_5 like Mac OS X; de-de) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8L1 Safari/6533.18.5"
104.238.205.70 - - [09/Nov/2022:08:20:42 +0000] "GET http://eqksp.drtjy.com/ HTTP/1.1" 400 55224 "http://eqksp.drtjy.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36"
103.195.103.32 - - [09/Nov/2022:08:20:42 +0000] "GET http://eqksp.drtjy.com/ HTTP/1.1" 400 55192 "http://eqksp.drtjy.com" "Mozilla/5.0 (Windows NT 5.1; rv:40.0) Gecko/20100101 Firefox/40.0"
104.243.37.94 - - [09/Nov/2022:08:20:42 +0000] "GET http://you.br-sx.com/ HTTP/1.1" 400 55133 "http://you.br-sx.com" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0"
173.208.239.195 - - [09/Nov/2022:08:20:42 +0000] "GET http://eqksp.drtjy.com/ HTTP/1.1" 500 588 "http://eqksp.drtjy.com" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.63 Safari/537.36"
104.238.205.70 - - [09/Nov/2022:08:20:42 +0000] "GET http://you.br-sx.com/ HTTP/1.1" 400 55147 "http://you.br-sx.com" "Mozilla/5.0 (Windows NT 5.1; rv:33.0) Gecko/20100101 Firefox/33.0"
104.238.205.70 - - [09/Nov/2022:08:20:42 +0000] "GET https://skype.gmw.cn/?7n62R0Ocp5h8ymbM74co76w370m0Cv HTTP/1.1" 400 55741 "https://skype.gmw.cn" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36"
104.238.222.9 - - [09/Nov/2022:08:20:42 +0000] "GET http://tucgd.lixil-kitchen.cn/ HTTP/1.1" 500 588 "http://tucgd.lixil-kitchen.cn" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36"
104.238.222.88 - - [09/Nov/2022:08:20:42 +0000] "GET http://www.wuqiaoxianzajituan.com/ HTTP/1.1" 400 55372 "http://www.wuqiaoxianzajituan.com" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
103.195.103.32 - - [09/Nov/2022:08:20:42 +0000] "GET http://tucgd.lixil-kitchen.cn/ HTTP/1.1" 400 55366 "http://tucgd.lixil-kitchen.cn" "Mozilla/5.0 (iPad; CPU OS 10_3_3 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) CriOS/61.0.3163.73 Mobile/14G60 Safari/602.1"
104.238.222.88 - - [09/Nov/2022:08:20:42 +0000] "GET https://skype.gmw.cn/?DnV7mPJ19L1Li6bwt39aVP59oDDi6bJxPb8Pj0 HTTP/1.1" 400 55775 "https://skype.gmw.cn" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0"
104.238.222.88 - - [09/Nov/2022:08:20:42 +0000] "GET https://skype.gmw.cn/?3as00v0ydeeRx5sXVa3wMoQ6 HTTP/1.1" 400 55676 "https://skype.gmw.cn" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36"
104.194.8.226 - - [09/Nov/2022:08:20:42 +0000] "GET http://you.br-sx.com/ HTTP/1.1" 400 55219 "http://you.br-sx.com" "Mozilla/5.0 (Linux; Android 6.0.1; SM-G532M Build/MMB29T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Mobile Safari/537.36"
104.238.222.88 - - [09/Nov/2022:08:20:42 +0000] "GET http://www.wuqiaoxianzajituan.com/ HTTP/1.1" 400 55434 "http://www.wuqiaoxianzajituan.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36"
104.243.37.94 - - [09/Nov/2022:08:20:42 +0000] "GET https://skype.gmw.cn/?I5RaB0sIBAt7W9i7iWueXU9104kJ HTTP/1.1" 400 55714 "https://skype.gmw.cn" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36"
104.194.8.226 - - [09/Nov/2022:08:20:42 +0000] "GET http://you.br-sx.com/ HTTP/1.1" 400 55238 "http://you.br-sx.com" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_2 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A456 Safari/602.1"
104.238.222.88 - - [09/Nov/2022:08:20:42 +0000] "GET http://px9i1.jntmzg.cn/ HTTP/1.1" 400 55245 "http://px9i1.jntmzg.cn" "Mozilla/5.0 (Linux; Android 8.0.0; FLA-LX3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.80 Mobile Safari/537.36"
...
199.127.60.99 - - [09/Nov/2022:13:19:50 +0000] "GET https://d518b.com/?s8023k1FRBDIvK6Rxw6q8h0e5S HTTP/1.1" 502 166 "https://d518b.com" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0/Nutch-1.12"
185.150.189.223 - - [09/Nov/2022:13:19:50 +0000] "GET https://d518b.com/?xCtRIk9u13N80G1J8xaWTF1GSLo80M6 HTTP/1.1" 502 568 "https://d518b.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36"
104.238.221.227 - - [09/Nov/2022:13:19:50 +0000] "GET https://d518b.com/?25HwH49w9C9UqapejfQ3HQCX02EKbegWgvG4 HTTP/1.1" 502 166 "https://d518b.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/600.3.18 (KHTML, like Gecko) Version/8.0.3 Safari/600.3.18"
104.243.34.218 - - [09/Nov/2022:13:19:50 +0000] "GET https://d518b.com/?v8iHIV5uWx4540GvN4apQ3dG3 HTTP/1.1" 502 166 "https://d518b.com" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0"
103.195.103.32 - - [09/Nov/2022:13:19:50 +0000] "GET https://d518b.com/?4FrrkvoMux8HR162L324b2 HTTP/1.1" 502 568 "https://d518b.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; InfoPath.1)"
199.127.63.156 - - [09/Nov/2022:13:19:50 +0000] "GET https://d518b.com/?A5cAxLa81Q52KCL752QK010X3NuQ HTTP/1.1" 502 568 "https://d518b.com" "Mozilla/5.0 (Linux; NetCast; U) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.31 SmartTV/7.5"
103.195.103.32 - - [09/Nov/2022:13:19:50 +0000] "GET https://d518b.com/?G2nga9Dw9q1Xy9bR7qBXB HTTP/1.1" 502 568 "https://d518b.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)"
They all seem to requests external URLs, (which I don't think my server needs to do for any legitimate reason), so I tried to deny them with my nginx config by denying matches to http, .com, cn, with this config:
upstream app_server {
server unix:/home/django/gunicorn.socket fail_timeout=0;
}
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;
server {
listen 80 default_server;
listen [::]:80 default_server ipv6only=on;
root /usr/share/nginx/html;
index index.html index.htm;
client_max_body_size 4G;
server_name _;
keepalive_timeout 5;
# Your Django project's media files - amend as required
location /media {
alias /home/django/django_project/django_project/media;
}
# your Django project's static files - amend as required
location /static {
alias /home/django/django_project/django_project/static;
}
# Proxy the static assests for the Django Admin panel
location /static/admin {
alias /usr/lib/python3/dist-packages/django/contrib/admin/static/admin/;
}
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_redirect off;
proxy_buffering off;
proxy_pass http://app_server;
limit_req zone=one;
limit_except GET HEAD POST {
deny all;
}
}
# ADDED THESE NEW LINES
location ~ http {
deny all;
}
location ~ .com {
deny all;
}
location ~ .cn {
deny all;
}
}
server {
root /usr/share/nginx/html;
index index.html index.htm;
client_max_body_size 4G;
server_name <MYURLHIDDEN>; # managed by Certbot
keepalive_timeout 5;
# Your Django project's media files - amend as required
location /media {
alias /home/django/django_project/django_project/media;
}
# your Django project's static files - amend as required
location /static {
alias /home/django/django_project/django_project/static;
}
# Proxy the static assests for the Django Admin panel
location /static/admin {
alias /usr/lib/python3/dist-packages/django/contrib/admin/static/admin/;
}
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_redirect off;
proxy_buffering off;
proxy_pass http://app_server;
limit_req zone=one;
limit_except GET HEAD POST {
deny all;
}
}
# ADDED THESE NEW LINES
location ~ http {
deny all;
}
location ~ .com {
deny all;
}
location ~ .cn {
deny all;
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/<MYURLHIDDEN>/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/<MYURLHIDDEN>/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = <MYURLHIDDEN>) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80 ;
listen [::]:80 ;
server_name <MYURLHIDDEN>;
return 404; # managed by Certbot
}
But these types of requests are still hitting my access log, and my servers CPU keeps hitting 100% and site keeps going down. What am I doing wrong?