Why does a new WP site immediately fall under Brute force?

Question

brute force

I am creating a site on WP:
admin login - a heavy arbitrary combination of characters, password - the same.
Immediately after creation, for example, I install a Sucuri plugin to notify about unsuccessful login attempts, and they appear on the very first day of the site.
I wrote to the technical support of the hosting, they said that apparently somehow the urls of the sites that I create and with which I work get into the brute force spammer database.
The working PC was checked for viruses, cleaned the hosting completely and loaded only the original WP, in general, even a clean version of the site without plugins and third-party themes goes brute force
How to be? Where do these brute force come from and what can it be connected with?

Answer 1

spammers and hacker tools constantly monitor the Internet for vulnerabilities, this is a very profitable business, so as soon as your domain or ip address gets into the scan lists at least once, they will break into you.

the brute force spammer database includes the urls of the sites that I create and work with.

check YOUR machine for viruses, yes, a banal plug-in in the browser that sends information to a spammer, in principle it is justified, put such viruses to developers, moreover, you can get access to the developer version of the site and if it is infected, it will be more efficient