Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords

For the second time my website seems to be the target of a large automated attack. It seems complex enough and very well executed. I have the following systems in place:

Captcha on 3rd failed login from IP
Account lock for 30 min after 5 … Continue reading Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords