Brute Force Hackers: How is this possible

On one of my clients’ sites, hackers seem to be using brute force tactics to find a login and password. While I understand there are many security plug-ins, my question has to deal with some thing else.

I removed the login page for my client, and used their Cloudflare service to block all people from accessing the login page. However, the hackers are still attempting to login via the login form even though it’s not there. I still get the email notifications that people are trying to login even when there is not a login page (it’s also not cached). How is it possible that hackers are sending info to WP even though it’s not there? I thought I might have to do with curl or something.

• This topic was modified 2 years, 3 months ago by t-p. Reason: Moved to Fixing WordPress from Requests and Feedback