Almost all WordPress websites receive a large number automated POST requests to wp-login from bots at regular intervals, sometimes originating from different IP’s each time. The web is full of such bad bots that slowly and steadily perform brute-force/ dictionary attacks on your CMS website and applications. Newly compromised servers are then added to the bots collection of servers for performing further attacks on other websites without the knowledge of the server admin. These attacks are mostly slow and highly distributed that brute-force protection applications cant prevent them without false positives