bot targetting ipn_main_handler.php results in lots of debug-log files but Paypal is not used for payments.

Zc 2.2.2 PHP 8.4
A bot targets ipn_main_handler.php and lots of debug-log files are generated. I do not use Paypal. A 50 second burst of access attempts generates 191 debug-logs.

Should ipn_main_handler be checking for some data to be passed to it?
It appears to fall through to line 493 which triggers errors in paypal_functions.php
Example debug-log
#0 /includes/modules/payment/paypal/paypal_functions.php(402): zen_debug_error_handler()
#1 /ipn_main_handler.php(493): ipn_create_order_update_array()
followed by
#0 [internal function]: zen_debug_error_handler()
#1 /includes/classes/db/mysql/query_factory.php(757): trigger_error()
#2 /includes/classes/db/mysql/query_factory.php(701): queryFactory->show_error()
#3 /includes/classes/db/mysql/query_factory.php(314): queryFactory->set_error()
#4 /includes/functions/database.php(134): queryFactory->Execute()
#5 /ipn_main_handler.php(494): zen_db_perform()
--> PHP Fatal error: FATAL MySQL error 1105: Only constant XPATH queries are supported :: UPDATE paypal SET payment_type = 'echeck', txn_type = 'echeck-cleared', parent_txn_id = 'n', payment_status = 'Completed', pending_reason = '', payer_email = '[email protected]', payer_id = '', business = '', receiver_email = '', receiver_id = '', notify_version = '', verify_sign = '', last_modified = now(), payer_business_name = 'b', num_cart_items = '1', exchange_rate = '1', memo = '{Record generated by IPN}' WHERE txn_id='zzz' OR (SELECT EXTRACTVALUE(1,IF(((SELECT COUNT(*) FROM orders WHERE cc_number<>'' AND cc_expires<>'' AND LENGTH(cc_cvv)>0)>=1000),CONCAT(0x7e,'x'),'//a')))#' > (as called by) /includes/functions/database.php on line 134 < in /includes/classes/db/mysql/query_factory.php on line 757.

Apache access log entry is: 177.7.42.47 - - [14/Oct/2026:20:57:26 +1000] "POST /ipn_main_handler.php HTTP/1.1" 503 4809 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"

How can I prevent this? Should I set up a block in .htaccess to restrict access to ipn_main_handler.php to allow onlyofficial Paypal IP ranges as suggested by an AI web search?