Store brute-force IP addresses

You can use wp_login_failed action for that purpose… It’s called at the end of wp_authenticate, if user credentials were incorrect.

function my_log_brute_force( $username ) {
    $ip_address = $_SERVER['REMOTE_ADDR'];
    // store that info somewhere
    file_put_contents( 'bf-log.txt', date('c') . "\t{$ip_address}\t{$username}\n", FILE_APPEND );
}
add_action( 'wp_login_failed', 'my_log_brute_force' );

Also this article may be helpful: Getting real IP address in PHP