If you are a valuable enough target, this is not an option. IPs are cheap, if you let someone try 20 times in an hour before banning an IP, there are targets t

If you are a valuable enough target, this is not an option. IPs are cheap, if you let someone try 20 times in an hour before banning an IP, there are targets that people will cycle through IPs that quickly for.