Repeated breakin attempts not stopped by AIOWPS

Hi –

First of all, thanks for a really great plugin!

I am having a similar issue to https://wordpress.org/support/topic/multiple-login-attempts-on-renamed-login-page/ (although I’m not sure the breakin attempts were coming from that page).

I see in my Failed Login Records list at /wp-admin/admin.php?page=aiowpsec_userlogin&tab=tab2 that there were about 100+ invalid attempts to log in to my site from the same IP address. They tried user names such as admin, administrator, etc. The attempts were a few seconds apart and the attack lasted a total of about 10 minutes at around 3am.

– I am using AIOWPS v4.3.6
– I have renamed my login page on /wp-admin/admin.php?page=aiowpsec_brute_force
– Neither the /wp-admin.php or /wp-login.php pages exist on my site, both return a Page Not Found error
– I do not have any admin accounts with names such as admin, administrator, etc.
– I have enabled the login lockdown feature on /wp-admin/admin.php?page=aiowpsec_userlogin with a lockout time length of 60 minutes
– I am using the Instantly Lockout Specific Usernames feature, and all these invalid usernames were in this list

I also blocked the malicious IP address once I discovered this, but I’d like to know how someone was able to make 100+ attempts to break in when their IP address should have been blocked on the first attempt.

Thanks!

Mike