It's probably just an nginx fail2ban jail or something that looks for the wp pattern.