I thought something before, when I check nginx's log, I found a wired hostname.
After checking, I think out website was mirrored.
I think they parsed their domain by CNAME to our domain, and we don't do any host check at that time.
To prevent being mirrored again, I add host check configuration in nginx.conf
set $flag 0;