I'm seeing this quite often:
No OS, same Browser, weird hostname -- they're definitely not real users. Can I do anything to take precautions before they do something?
Some more info available in this wp beginner post: http://www.wpbeginner.com/plugins/how-and-why-you-should-limit-login-attempts-in-your-wordpress/
Since it looks as there is no referrer you could block the attempts with .htaccess. Something like this:
There are different variations on that, you could even just trying using REQUEST_URI instead.
Or if you're the only person logging into your site you could lock it down even more like so:
Where xxx.xxx.xxx.xxx is your static IP Address. Can be modified to just work for Class A, B, or C if you have a dynamic IP Address.
Where example.com is your TLD. That way they're just redirected to your home page.