We've been logging GET requests on our domain to the following:
XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG
Is this a known kind of attack? What might it be targeting?
This type of "attacks" can be used to generate a 404 message. Hackers do this in order to find out what kind of web server you have. Or to find out what kind of framework you use. (Based on the structure of the 404 HTML code.)
If they find out what server you have and what CMS/framework (and version) then they can use this information to hack into your website.
I recommend you to keep everything up to date. There is not a lot more you can do against those requests.
Try asking on https://security.stackexchange.com/
It doesn't look like a hacking attempt, unless Your CMS/framework has some functionality on XX/YY/ZZ/CI/ path.
