Failed Logins

First off, love the plugin! It’s been super amazing for devs on many sites. I was hoping for some tips. I’m getting hammered with failed logins. I’ve done the following through the plugin:

– Changed Login URL
– Enabled Captcha
– Enabled Honeypot
– Enabled the login lockout if failed too many times
– Also provided instant lockout if they use specific usernames.

I have black listed some IPs but they seem to be getting smarter and more random. One of the most common usernames they try is [login] and I think the instant lockout doesn’t work with that one since it’s got characters.

Anymore tips? It’s like they are avoiding the login page all together. The Captcha didn’t slow them down at all.