Brute Force protection.. issue

As previously mentioned, it is highly likely that the bots are not actually accessing your login page but these attempts are being done via xmlrpc.

We have introduced an improved rule for the pingback protection feature which should stop those attempts – this will be available in the next release.
In the meantime you can try the following:

Using FTP grab your .htaccess file and replace the code in between the tags “#AIOWPS_PINGBACK_HTACCESS_RULES_START” and “#AIOWPS_PINGBACK_HTACCESS_RULES_END” with the following directives:

<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

Then monitor your login attempts to see if they cease.

The above code did resolve the issue.

Thanks,