Why just those two countries then? Why don’t I see a thousand get requests for /wp-login from countries all around the world? Wouldn’t that be significantly more effective since you can’t simply block a range of addresses to mitigate it?