I use fail2ban on my servers, along with WP Fail2ban plugin. After just 1 attempt to log in with admin, I place a permanent iptables ban on that source IP.

None of my users have a legitimate reason to log in as admin, so 100% of those attempts are attackers, and this just removes the problem at source.