These are legitimate packets. By using version 1.1 of HTTP the client is required to send a header field named "Host" which indicates the virtual host the request is aimed at. In the cases below, the client did not indicate it. This is described in RFC2616 section 14.23. These sorts of packets should not compromise the server.