well i'm thinking about again, maybe just a syslog could do the job with fail2ban

but in windows... well it will not work

maybe the second option of a internal table could do the job too

Host | bad_login_datetime 

if host have more than 'bad_login_tries' bad logins in 'bad_login_seconds' seconds before now  it will be disconnect

after xxx seconds or after each minute, or after each disconnect clean the internal table that have bad_login_datetime < now() - 'bad_login_seconds'

the clean should be optimized in a not paintfull way (maybe like a garbage colector that runs after X disconnects, or a event that happens each x seconds, or both of them, i prefer the disconnect method)

any other idea?