I am in the process of developing a php/mysql based web application. I took the complicated route and rather than to use a framework or anything I built the entire foundation of my app from scratch. This all while I learned how to REALLY code (I knew very little, now I'm quite advanced. But faaar from expert or professional I think...)
I made myself custom 404 error pages, which record the URL the user tried to see, the URL they came from, and all variables that are active in the context, including IP address. This is to track down errors on my site, and to kinda detect hacking attempts.
Ever since I've put a BETA version of my site live like 5 months ago, I've had a few (less than 3) bots come by, trying to get access to wp-login.php Usually those were not more than 5 requests made and quite certainly from a bot, because of how fast the requests were made.
Those didn't bother me much (eventhough I did report the on IP to godaddy, because their name showed up with it). Since I don't use wordpress and the directories that were attempted for penetration don't even exist.
Today however an IP address located in Spain spent 20 minutes on my site and made over 60 requests to URLS like
The list goes on and on...
I am uncertain if this was an automated attack or if there was a person actually trying each URL, since it's only about 3 requests per minute.
Fortunately none of those requests yielded any results, since most of them were targeted to non existing directories, those that tried to pass GET variables did not have an effect, because those variables wouldn't have been used by my scripts.
So while I am a little proud of myself, that such an elaborate attack has not done anything, which shows me that my code base is quite solid, and not easily to penetrate, I am also nervous because a bit I feel like I might have gotten lucky that I use rather unconventional directories and file names... I was very mindful of security when programming my application, but I feel so weak, because of my background...
Also I wonder what the hacker's goal was to try all these URLs. It's free to register an account on my site... ?! And the exploits of my site are currently super duper low... only about a hundred email addresses is about the most valuable thing I have in my DB.
The entrepreneur in me is thinking that a competitor of mine tried to penetrate my site... :-D
So besides the highlighted indirect questions, my main questions are:
What should I do with the information I got today?
Should I put mechanisms in place that simply block IPs after a certain number of unsuccessful page requests within a certain amount of time?
Is anyone familiar with this specific attack?