Brute force attacker username admin

Well, if you disabled http/https for the wan interfaces, maybe they are ssh attempts?

I would advise you to use trusted hosts for all your administrators.

If one user/admin doesn't have trusted hosts enabled/configured , the mgmt ( ssh/http/https ) will still be opened from everywhere and attempts/brute force can be made ( the good part is that even they know the pass for the user that has it configured but the src ip isnt the one in the trustedhosts it cannot be accessed/permitted ), but if for all are configured nothing ( no prompt to enter credentials ) will be made available for them.

Another option would be to use local-in policies, cli configurable only.