I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such as 18.104.22.168 (google's public dns) as the origin of some of the login attempts.
I use WordFence to detect and block these attempts, but the block is based on IP, so it's not so efficient.
My question is:
Is it 'normal' for low profile WordPress sites to get these 'attacks'? I've notices an increase in the logs during the first days of 2013.
Is it something to worry about, and is it possible to detect/verify if a login request is coming from a spoofed IP?