You need this…

I blocked 3 IP network, but hacker bots kept coming from a country unrelated with my content. The hacker bots not only doing bruteforce on all login, but also exploit all possible plugin weakness. There’s no way to guarantee all plugins will be secure at all time on all updates.

Blocking the country with IP-Geo-Block solve the problem.