yave20b,

At a glance it may be a form of web service or cross-site request forgery attack. I won't get into the details of how they actually work. It's rather technical & there are many different ways to attack. If it follows the same pattern, it might simply be an automated scanner looking for holes. If it is a person doing it manually they don't seem to swift to keep trying the same pattern if it's clearly not working. There are a lot of script-kiddies or wannabe hackers. Who attempt to use tools with no real understanding how they work or what they are doing. Which is a good thing for the average user !. As someone shifting from the general I.T field into the hacking field (as an ethical hacker.. i.e good guy). I can't say what they are trying to do from the logs. The hacker mindset is rather unique & there's no standardized method hackers follow. I can only vaguely guess, even then it's impossible to get in someone's mind. No two hackers think alike.

What I would do personally is keep an eye on the logs, make sure all web scripts are up-to-date. That the files/folders don't have unnecessary access, i.e 755 permissions. Also do regular backups just in case. The reality is no computer connected to a network is safe from attacks. Web hosts being a prime target. Since it only takes one unsecured account on a shared server to get in. As long as there's no noticeable damage or changes, that's the main thing.