2

I've implemented Django's relatively new allowed hosts setting, which is meant to prevent attackers from submitting requests with a fake HTTP Host header.

Since adding that setting, I now get anywhere from 20-100 emails a day notifying me of invalid HTTP_HOST headers. I've copied in an example of a typical error message below.

I'm hosting my site on EC2, and am relatively new to setting up/maintaining a server, so my question is what exactly is happening here, and what is the best way to manage these invalid and I assume malicious requests?

[Django] ERROR: Invalid HTTP_HOST header: 'www.launchastartup.com'.You may need to add u'www.launchastartup.com' to ALLOWED_HOSTS.
rolling stone
  • 123
  • 1
  • 5

1 Answers1

6
  1. it looks like Amazon has given you IP address which has been assigned to some other customer previously and this customer has not changed A record for their domain name.
  2. There are bots or crawlers who crawl internet all the time. Vulnerability scanners, web crawlers, monitoring applications.

You should not worry about them, it is background noise of the internet.

Kristaps
  • 2,985
  • 17
  • 22
  • +1 Thanks @Kristaps. Quick followup question - what about those requests that reference the server's IP address? Any reason to be concerned about those? If so, is there a way to prevent them from accessing the server instance (using Amazon's ELB for example)? – rolling stone Nov 02 '13 at 17:26
  • The same - just some bots – Kristaps Nov 03 '13 at 21:27