my API is built on nodejs , I'm using a looger package that shows strangers requests comes to my API that I don't know about these requests, requests like /.env, /PHP files, all requests as shown in the image below do not exists in my API or frontend

my API deployed in digital ocean company.