I am using WordFence security plugin for keeping track of login attempts and I regularly check the logs from it. I realize that there are going to be a lot of login attempts with the username 'admin'. Most only try a couple times and leave the site alone. However, I am having one particular attempt that is more troubling.
I am receiving multiple login attempts from Italy and each day I check it, the logs are filled with new login attempts from Italy. The brute force attempt is using the wrong username so I am not worried at the moment of them getting in but I would like to limit these automated attacks. Normally I would just block an IP like this but the problem is this seems to be coming from a lot of different IP's all with the location of Italy. I went through them and I didn't find any with the same IP. Most start with 93.x.x.x or 78.x.x.x however thats about as similar as they get.
What would be my best course of action to stop these attacks? I don't want to block the whole 93.x.x.x or 78.x.x.x network because that could potentially be a lot of traffic and I feel as if that is just a "band-aid". Would getting a CAPATCHA for the login help? Anyone else overcome an issue like this?