[s0ulphire]

Not many places will try a brute force attack directly on a login interface, but if your database is leaked the definitely. Nothing to rate limit an attacker then