PamPro

Thanks for the insight.
It was rather odd to me. No issues for ages, then in 3 days a high number of lockouts (4 on wed; 0 on thur; 9 on fri; 29 on sat and so far 68 on sun)
The part that upset me most was when I noticed one of those failed attempts used an existing username (which I addressed, of course).
within 60 seconds of that change, a very specific no-longer-active username was attempted from 3 different IP addys in China.