Ask HN: Requests for Twitter.com, paypal.com, etc in my Nginx logs

Hi. I have started to see thousands of requests in my nginx logs for domains like twitter.com, paypal.com, cloudfront.net and many others. Does anyone have an idea of what they are trying to do? It's the first time I see this kind of behavior/attack. It was causing high load issues on the server because I was testing the lua extension for nginx (actually openresty) that allows requesting new LetsEncrypt certificates on the fly automatically when a request for an unknown domainis received for the first time. This is because my app will let users use custom domains. So all those requests for those domains were triggering requests for certificates from LetsEncrypt which of course resulted in rate limiting etc (429's and 400's)... I have now disabled this thing while I implement a restriction that will let the lua extension request new certificates only for whitelisted domains, otherwise falling back to a main certificate. But yeath, I was wondering if anyone here knows what they are trying to achieve. Thanks in advance.