Ever heard of counting attempts? Log the IP, present a CAPTCHA after 100 requests in a minute.

Ever heard of IP rotation? This is one malicious source rotating through IPs over the course of 24 hours. They’re attempting to credential stuff my logins ( on a production service ).