[rovr138]

Different attacks.

If you have a network, 1 IP could then try 1 time a user + password. Then switch to another device with a different IP for another one.

The first IP could then try a different user.

You need a combination, not one or the other.

And then, you have to deal with a university or other big institution and users forgetting their passwords after the holidays. That would potentially trigger a ban of everyone.