Request from unknown party, Sogou

Question

I am hosting a simple prototype on Amazon Lightsail and I saw some strange requests on my Django server. Is it anything to be concerned about?

Invalid HTTP_HOST header: 'fuwu.sogou.com'. You may need to add 'fuwu.sogou.com' to 
ALLOWED_HOSTS.
Invalid HTTP_HOST header: 'fuwu.sogou.com'. You may need to add 'fuwu.sogou.com' to 
ALLOWED_HOSTS.
Bad Request: /http:/fuwu.sogou.com/404/index.html
Bad Request: /http:/fuwu.sogou.com/404/index.html
[01/Aug/2021 02:50:44] "GET http://fuwu.sogou.com/404/index.html HTTP/1.1" 400 63056
[01/Aug/2021 02:50:44] "GET http://fuwu.sogou.com/404/index.html HTTP/1.1" 400 63066
[01/Aug/2021 02:50:51] code 400, message Bad request syntax ('\x05\x01\x00')
[01/Aug/2021 02:50:51] "" 400 -

Bisector

Experienced the same thing today. Seems they are a Search Engine company from china, subsidiary of Tencent: en.wikipedia.org/wiki/Sogou. Seems that alienvault has them whitelisted: otx.alienvault.com/indicator/domain/fuwu.sogou.com ... although it seems a bit suspicious the HTTP, like a downgrade attack? Putting this as a comment as it's not answer-worthy yet – Brettbretz

Answer 1

Public-facing services will always receive all kinds of constant random scans and attacks - these can range from cybersecurity organizations like Censys, Netsystems, etc. to weird HTTP requests attempting to take advantage of a well-known CVE.

These may be done by people or automations setup by people with skill levels anywhere from professional to "script kiddie.", and these can originate from your country or anywhere else on the globe.

These types of things have a high enough chance of coming from people who have no interest in using your service legitimately that doing the following may be worthwhile:

• Find the provider subnet that the IP belongs to through a WHOIS domain lookup tool.

• If the provider is from a country whose language you don't support, block the entire subnet - preferably on the firewall level.

Bocock