Hidden Backend address not efficient

Hi,

I setup Ithemes securuty, and change the backend adress among a lot of security actions.
I also deleted xmlrpc.php file. But 25 minutes ago there was another force brut attack, and it seems that the new backend address has been found as I could read in logs.
(https://mywebsite.org/wp-login.php?itsec-hb-token=MyNewBackendAddrees)

Hope someone can help to sort out this issue.

Thanks in advance.