Find IPs to block by counting the number of login requests per IP

[bobbingwide]

On a newish site I noticed thousands of requests to wp-login.php from the same IP address. The only thing this site was trying to do was login, using a dictionary lookup for passwords.

Blocking the IP reduced the number of requests to the site to a manageable level.

I realised that it would be easy to detect the IPs that should be blocked simply on the type of requests they perform.

Requirement

1. Routine to analyse the daily summary report to find IPs that should be blocked.
2. Some automated routine to be proactive rather than reactive.

I imagine Jetpack's Protect does something similar. And maybe Wordfence as well.