@mike finley - While Wordfence is a great plugin, and one I wouldn't be without, in the case of a Denial of Service attack it's a lot less server-intensive if you can stop it via your .htaccess before it gets to your wp-login.php. For instance if you are the only one who ever needs to login then just whitelist your own IP(s) and send everyone else - bots included - to a static 401.html page.