Obviously, what I described was a "basis description". There are many tricks employed to decrease risks of legitimate IPs from being banned. For example, only i

Obviously, what I described was a "basis description". There are many tricks employed to decrease risks of legitimate IPs from being banned. For example, only invalid login attempts from the same IP with several non-existent and invalid password accounts are counted and then counter is reset every 24 hours. Based my site's usage patterns, legitimate users are very unlikely to get flagged in those situations, but I've successfully banned over 65k IPs of botnets trying to bruteforce over stolen email/passwords combos..