What URL are brute force attackers using?

I’m using All In One WP Security plugin to protect my WordPress site and I’ve enabled almost every security feature it offers (some just don’t work reliably) but I’m still seeing at least 20 or so brute force login attempts each day. They use a variety of usernames and come from a wide variety of IP addresses so it’s hard to block them pre-emptively, although I try. I’ve even changed the WP-ADMIN.PHP to another location to deter them, but they keep coming.

My big question right now is how are they finding the WP login to attempt these brute force attacks? Have they found my re-named WP-ADMIN page? Or is there some other shortcut they can take to get to a user level login page? I don’t operate a member site and I don’t recall there being any pages where a login link is displayed. But maybe I’ve just forgotten?