Putting random login pages at /wp-admin/ is great for farming IP ranges to block. They don't even need to go anywhere, all you need is a form with a login button and bots will try to log in.
You should drop down a few layers on the OSI model and catch this at your reverse proxy instead of publishing login pages to catch every permutation of 'wp' in urls.