With Django 1.5, HTTP_HOST header filter is applied to the requests. If the HTTP_HOST header is not among the ALLOWED_HOSTS list in the settings.py, an error is raised, saying this is a suspicious operation.
Let me give an example. Someone (who is not Google), is trying to reach my IP address with the HTTP_HOST www.google.com as if I'm hosting the google.com homepage.:
SuspiciousOperation: Invalid HTTP_HOST header (you may need to set ALLOWED_HOSTS): www.google.com
This happens frequently, leading to emails sent to the admins which is annoying. To overcome this, you can add the IP Address of the requester to /etc/hosts.deny file.
Indeed I thought I could put a hostname filter in nginx configuration, especially in the listen part but my configuration did not have an effect.
The attacker tries to exploit a vulnerability and performs a scan over the web. They seem to be from Vietnam.