Weird requests filling apache access logs [closed]

Question

I'm running a public apache2 webserver. I'm getting a lot of this kind of requests on my webserver:

91.251.142.16 - - [07/Mar/2020:19:58:09 +0100] "\xe8\x95h\x8d\xf0\x1d\x99Q\xb8~\xb5\xbc\xa7*\x1c\xe1\x07\x10\x0c\xce\xc4\xb5<\xa3\xfb8\xf1\x19\xcb&N\xbc0\xdd\xad@\x82\xd0.\x8f]n&:\x8d\xcfnW\xe7\x11\x803o{X\xd43oPo\xbc\xb19\x94\xb3\xb5\xb9\x15k\xcf\x06\xe1\x19h\xb3cb\xc9\xf2\xbe\xa4A\vX\xc9\xd3Rx\x0c\xfbzIFA\xd6\xe7C?2\xdd\xbe\x1d\x96^\t\xcfq\xe5\xaf7Cl\xab\xc7\x18\x81:^p\xcf\x10!\x95\r2T\xc3b\xa1r\xcdNSS\xc4R;-\x98\xef\xf25\xc2\x90\xa2\x95\xfc\x9e/\xdcy\xc0\x8e\xa2I\x0fd\xdb:\b\xb2\xf0\xe3V\xd1\xaet0c\xbb\xc8\xe7\xc6\x98>\x82\x83K\xdcp\x7fA\x9f\xc6\xe1\xfc\xf6\x10#\x13\x95\xd6\x98\x80\xe2\x1b\x9b\xfe\xa4\xda^_\xa6\x04\xf3\x86;y\x13\xfb\x8d\xb8\xb6\xee\xc2qT\xef\xed\xcf\xe5L\x8f\xf4T-Y\x82\x84n!\xc4\x8c\x02QUP]\x99((\xb5\xf07+\xfeT\xd8K\xf2y0\x1a\xd1\xf4z4\x13_B\xcer\xe4\x86@]\xca\xc5o\xaemm\x89\xf1\xaa\x84z\xfa\x82\xc6\xd2\x15\xc8\xf0$'x\xc1\xcc\xc4r\xf8\x9cI\xe5^\xfa\xd1\xa3\x9c\x85\xbb'W\xb2\xa1\x17 l\xa3\xfd \t9\xc5\x94(\x9f3\xf818$\x17b\x17\xb2\x8f!4R\x80\x82\x92*\xf3\xd4\x83h\x99\v\xa7I\"\x9c\xe6\xcfN\xab\xee\x834y\xe1\x11\xecf1\vZ\xc0\xaa9\xaf\x86RGM\xe3\x80\x9e\x9eH8\x13P2\x15\xe4$\xdfAM;\xb8\x99\x9eO\xec \xfc\xa3Mo\x81M\x9d\x851\xd3g!\x90\xdd\xb3\xb9U^\xd1\xa3\xc6\xe1G\xd9\x1d\xa2\xc0/\xd7\xce\xefM\xbc X9\xa0M\xb4\x94\xdbY>g\xc0$S\xdc\x87.\xbc\x95\xf7\xa1ct\xd6\xa9\xf3\x16\x91\x99\x9ep\xe0\xcd[\xd5\xf7\xbdn\xd2\\!\xca\x8e\x13LG\xbc\xa3\x9d\x01\x1awl\xc1\v\xaf\x02G\x05\x02\xddl\"m\xc4z\xef\xca\t\x12S\xf8\xf6\xbbRo\xc9\xe55y\xaa#\xd0\xd4\xa3Y\x8b\xd48f\xcd\xe0gaj\x7f;\v\v\x8c<\xa0^\xcd\x15\xfcAT\xdc\x81H,\xd6Y\x88\"\xc8zWv^jS\xfb|Cz\x84b\x88;\xf2\xc2o\x1ay\xc9\xf2\x1a\x01\x7f\xc6\xc2%/\x11j\x825|:\xc2\xc9-\x9a{Sx\"\xa8A\x06'\x0e\xa7\xe7UK\x11\xbc\x1a\xfeU\x0f\x82l\x9c\x0e\x94\x87\xf8\xed_\x1c\xd0\xee,\xb6>\x97\x17\xe3pk\xa0\xed\xdaKh^\xc9h,\xfc3\xa9p\xb3\xea\xf2h\xb4\xf5>\x1e\x9b\x18w\xf3\xb5\xd0\x84u\xcd! \xf5\xb0\xbd\n" 400 0 "-" "-" 91.251.142.16 - - [07/Mar/2020:19:58:14 +0100] "\xab\xa1\x8d\xffGu.\xae\x94\xdb\x16@\x1d\x01\xc0M\x19\xae\xf8\xabKIE\xe2\xb2\x11;\x80\xf2\x9dnM-\xabi\x15f\xfan\xf3fcGA(k\x1e\xb1\x14$\x10 6\xd5\x16\xe2\x10\x8b68\xe3\xbcv\x8e\x83j\xab\x19F\x8f" 400 0 "-" "-"

Anyone has any idea what kind of exploit is tried here?

Answer 1

You're looking at a hex-escaped string. After some googling, I found this entry on server-fault: https://serverfault.com/a/758511/90491.

You're looking at a non-decrypted HTTPS request.

From Link:

You are most likely seeing this because you are making an HTTPS request to an HTTP endpoint. For example, you're sending an HTTPS request to port 80 of your web server instead of 443. As a result, the HTTP endpoint gets a bunch of encrypted data, makes no effort to decrypt it (since HTTP is supposed to be plaintext), and so you get a bunch of gibberish in the log file.