There are a lot of systems that can follow this style of approach to dealing with the baddies. Bear in mind our gear these days have huge amounts of RAM and a

There are a lot of systems that can follow this style of approach to dealing with the baddies. Bear in mind our gear these days have huge amounts of RAM and a fair bit of CPU. We have kernel based firewalls that can handle utterly huge tables and highly sophisticated queueing mechanisms. Heading into userspace we have mailer daemons a plenty, Squid, HA Proxy and the like, all of which can be used in this way. For example if you enter three bad usernames into a certain Exchange OWA I manage, then HAProxy sends you off to a fake login page and I hoover the data. If you enter a legitimate username but multiple incorrect passwords then the same thing happens. The fake login page runs rather slowly but not too slow. IPs that fail are fed to the firewall. I maintain a whitelist of IPs for users that have a static IP at home. If a legitimate user falls foul of that lot, they are reminded about VPNs. Funnily enough simply ratcheting up your TLS to 1.2 minimum fixes an awful lot of cracking attempts. Older unpatched systems simply can't even connect, let alone try to login. Sadly this wont be an option for many orgs (someone will insist on owning some wanky old thing and be too stingy to upgrade it and have enough clout in the firm to foil you) but as I happen to own mine I get to lay down the law 8)