Its hard to do at application level, because you might have a multi-thread or multi-server setup.

Luckily, there's out-of-the-box solutions that are easy to set up, e.g. Fail2ban.

Fail2ban scans your server logs, spots repeat login attempts, and sets up a temporary iptables ban on their IP.