title: Block request for multiple unsuccessful logins for a period of time
body: <p>I have a web site and I want to block request from <code>BOTs</code> and attempt brute force login to my web site.</p>
  
  <p>Now I'm using <code>Session</code> for storing login attempt and show captcha after 3 unsuccessful login but there is a problem.Session will be removed, if user closes the browser.</p>
  
  <p>What kind of solution I should consider to prevent <code>BOTs</code> and brute force login? What property of user system or browser I should store to manage his/her next login?</p>
  
  <p>Edit 1)</p>
  
  <p>I don't use ASP.NET Membership provider. I'm using  my own authentication and authorization classes</p>