Unwanted endpoints are invoking the application deployed in EC2

Hello Team,

In EC2, I have deployed a flask application with port 8000. For security, I am converting the http requests to https requests using application load balancer and route 53.

I configured the security groups to allow only http (8000) and https (443) and source is 0.0.0.0/0. I have applied same security group to load balancer.

In Network ACL, I am allowing all traffic.

The issue is:

some unwanted/not configured IP address endpoints are hitting my application. lets say, I have configured the ec2 to 12.23.42.23 and configured domain requests (https://example.com/api/hit), but ec2 is allowing other IP addresses (32.43.23.23). I see many not configured IP address calls are hitting the application.

So, I am tried to restrict the Network ACL to allow only 8000 and 443. But no requests being reached to server.

Please help with the details what is the security group for ec2 and load balancer to be used. and also network ACL to allow only 12.23.42.23 and configured domain requests (https://example.com/api/hit)