I'm running Opencart, an ecommerce CMS on a public website.
About a week ago I noticed a decent spike in direct traffic in Google Analytics (meaning these users input my URL directly rather than being referred organically or through social media) on a single day. The next day traffic was back to normal. This was quite strange, and I found that most of these users were from the USA and some were from France/Germany. My site services customers in another country, so this traffic struck me as odd, but I didn't think too much of it.
However, more recently a bunch of new customers have signed up under the exact same name using different email addresses and different IP addresses. There were 5 in a row, each 1-3 hours apart. Again, this is unusual - it's never happened before on this site. At the time I thought OK, maybe I'm being spammed, although site performance has been fine since this started.
What freaked me out was the most recent signup. This person set their name to "DbLks Trackr" and had a similar email address. I then looked at the IPs of all of these signups - this most recent one and the ones with the same name. Most are proxies, two are Ukrainian and one is American.
I'm thinking my URL has been posted on some forum or IRC and people are planning to try and take the database, which is why they're signing up.
It's not a very big ecommerce store at all so I didn't think it'd be much of a target really. I'm pretty sure my own PC isn't infected, but my Opencart version hasn't been updated in a while.
What's going on here? Is it likely they could access my database through an SQL injection or other means? Or is it likely to be harmless trolling?
UPDATE: proxy traffic is probing my site, looking at js and image files. Seems like a bot or bots looking for a vulnerability or the admin page.