[_indigo1]

You can detect brute force attempts through heuristics, you don't have to rely on basic 'max retries' logic.