Multiple Wordpress hacking attempts
As mentioned in other threads, most often these hits come from infected user accounts at ISPs. A user, just like you or I, gets their account infected with a virus by opening an infected email, visiting an infected web site or downloading an infected file. The virus (script) then uses that account to send out probes to see what web sites are vulnerable to infect or spam or hack in some way.
Sometimes these hits do come from infected servers at hosting companies, colocation services, data centers, VPN, Cloud Computing (e.g. Server Farms.)
In either case, the infection is usually detected within a few days and fixed. It helps to send the admins (abuse@example.com) a report of the activity by including a raw log snippet, your domain name and the IP address of your server. Too many of us don't report it. Holding the server admins accountable is the best way to affect change.
Since these infected sources are almost always temporary, rather than block the IP range, it is more effective to block the behavior. If you do use Word Press, make sure to quickly install the security updates when they become available. If you do not use WP, just block the request for these files and live with the 403s. I get several hundred every day.
