My network of WP sites got hit with some fool from Asia trying brute force log-ins and other nasty acts from a bank of IP’s. All were foiled but as above it’s a wise choice to make sure you passwords are not just alpha characters. I now use 15 alpha upper lower case included numerical/special characters too.
If your using WP change your user id from the generic “admin” too. I’d also highly recommend WordPress › Wordfence Security