One of my clients has a WP site that is essentially in "archived" mode. It was once popular, but he hasn't updated it for years (but we do keep WP itself updated). He recently noticed absurd amounts of traffic to some uninteresting, seemingly random 404 URLs on the site, like to
There's also a large amount of mystery traffic to some old legit URLs, but not nearly as much as to these. The top visiting operating system on this site is from "Unknown" (37%). I noticed quite a bit of traffic from Russia and China, and have blocked those countries in .htaccess, but the mystery traffic to the strange URLs persists.
What are common source of requests like these? Any best practices you guys would recommend?