Security - is my website under attack?

The only way you can really determine whether a 404 request was malicious is if they were requesting a page that is used for a known attack. For example, I get a lot of requests for wp_admin pages, which are most likely scans for vulnerable WordPress sites. However, it's unlikely that the IP address is permanently assigned to the attacker, or that the person using that computer is even aware that their computer is scanning the internet for vulnerable servers. It's also pretty unlikely that anyone is specifically targeting my server when I receive these requests.

If you really want to look up the IP address, you should be able to match up your CodeIgniter logs with your web server's logs, which usually include the client's IP address.

Bonfire

Practical CodeIgniter 3
CodeIgniter Testing Guide