[asveikau]

You're saying the malicious requests are hitting the obscure path that only shows up in her apk?

Is it running https? Trying to think of how they would have gotten that, eavesdropping would be one way.

Otoh if they are hitting your host by randomly probed IP address but don't know the obscure path, that is not surprising at all. There are tons of exposed http ports unknown to their operators, and it is makes total sense that bad actors are trying to discover them.

[unexistential]

No, thankfully they're hitting paths like /phpmyadmin/index.html which do not exist on the server. Makes sense, it's probably random IP address based probes long you said.

I'm not running https but I should, to protect myself from someone MITMing the requests and possibly pwning my Pi.