The number of characters is limited for additional descriptions. I want to know if I can block these requests? What level should be done?

This was just a few requests to view. Requests from all over the world IP were sent to the server. Thousands of requests have been received with the same structure in Nginx logs.

true log should be something such as the following: 37.98.68.156 GET /wp-content/uploads/2015/04/xx.png HTTP/1.1" 301 0 "r.yxzyxz.net" "Mozilla/5.0 (Linux; Android 8.0.0; SM-A320F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.99 Mobile Safari/537.36" But it seems our Nginx logs were not Normal during attack time! How should we find out what domains are requested from these messy logs? Moreover, suddenly the server bw increased from normal range 10-20 Mbs to around 500Mbs and the Nginx connections increased to 6000 which was 10 times more than the usual time as well.