Yeah, when the antennae twitch, take notice of them.
I always find that when someone tries to break my systems, it's because they're up to something. Everything I do is set up because it pre-empts something that's been a previous problem.
I did see an unusual one today that I hadn't seen before. I let people pay by PayPal if they have an account, but I identified a massive security hole with the way PayPal deals with debit & credit card payments. So I use an alternative provider for card payments. I regularly scan the list of transactions to see why failed ones fail. Mostly it's mis-matches between address and postcode, or occasionally "bank declined - insufficient funds". But today I saw "bank declined - stolen card." That was a surprise ! It's a buyer definitely going onto my blocked list....