I'm a developer (not wordpress though) at a company. We use an EC2 instance to host our wordpress site. I don't actually have an account named "admin", but we do have iThemes Security Pro which permanently bans IPs that attempt to login as the user "admin".
About a week ago, I got a site lockout notification from an IP in Brazil, and one more in Ukraine, where those IPs had tried to gain access through the admin username. I thought it was fine, but in the past few days, I've been getting emails every 15 minutes or so saying another IP has been locked out for trying to login as the user admin.
I thought I would do an IP wide ban for that page for certain IP addresses, but I'm realizing that all recent attacks have been from in the US. And as time goes on, the IPs seem to be getting closer and closer to where the actual server is located (in Oregon). Another thing is, all of these IPs appear to be registered with Amazon, so they might be EC2 instances themselves.
To try and keep up with it, I attempted to put a captcha on the login page using the following plugin. The captcha does appear on my admin login page. However, the bots are somehow able to get past this and attempt to login without completing the captcha.
Does anyone have any advice on what to do to stop this?