IP Blocked

Every time an IP is blocked temporally it's always been 5 attempts in a few seconds so it's a seasoned hacker for sure.

JT

I would venture a guess at someone using primitive "brute force attack" to login, those are automated and can do much more than 5 attempts at login in inside a second, but usually they are set with some delay between attempts to avoid getting black listed.
Then again, this can also be done by a virus/worm that finds credentials and web sites and tries to login to everything it found with every password at it's disposal.
Using Linux pretty much eliminates the second option.