The administrator should track the source of the log-in attempts and block the IP address in the Web Application Firewall (WAF). This will prevent further unauthorized attempts from that source. It is also advisable to reset the user's account credentials as a precautionary measure.
Reference: Incident response and addressing unauthorized access attempts, including tracking and blocking IP addresses, are security measures addressed in the CompTIA Cloud+ material.