@_az Thanks, I went through access.log and found out what maybe happened. They came form Firebase:
/var/log/nginx/access.log:66.249.92.9 - - [26/Jan/2018:10:36:43 +0800] "GET /.well-known/acme-challenge/0uOPNpUYZnr5gdMzC2lvhjSFpoyW3-LKylmoSAUUpws HTTP/1.1" 404 162 "-" "Google-Firebase"
/var/log/nginx/access.log:66.249.92.213 - - [26/Jan/2018:10:36:46 +0800] "GET /.well-known/acme-challenge/IS_wD9jF1prgOxPGTSg4mT2S86OfrOemoOyksDwsAMs HTTP/1.1" 404 162 "-" "Google-Firebase"
/var/log/nginx/access.log:66.249.92.94 - - [26/Jan/2018:10:37:44 +0800] "GET /.well-known/acme-challenge/0uOPNpUYZnr5gdMzC2lvhjSFpoyW3-LKylmoSAUUpws HTTP/1.1" 404 162 "-" "Google-Firebase"
/var/log/nginx/access.log:66.249.92.211 - - [26/Jan/2018:10:37:47 +0800] "GET /.well-known/acme-challenge/IS_wD9jF1prgOxPGTSg4mT2S86OfrOemoOyksDwsAMs HTTP/1.1" 404 162 "-" "Google-Firebase"
My site was hosted in Firebase few month ago, but I've deleted that firebase project and hosted on my own vps now. Looks like Firebase try to renew the cert with my deleted project?
Don't know how to stop that (wait for more days till they got tired?) but at least I know what happened.
Thanks again. 