I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests are partially hex encoded. I have tried decoding them, but still couldn't tell what their aim is. Here are some examples:
The server returns 400 for all these requests. Regardless, I would like to block these bots from making these requests since I don't want them to succeed at whatever it is they're trying to do.
I use fail2ban but it isn't configured to stop these. Should I set-up a special filter to find these in the logs? The only consistency that I can see is they all have "\x##" where ## is a hex code. However, I don't want to block any legitimate requests, so the filter needs to target these bot requests only.
Any ideas on how to do this?