Consider not blocking ip addresses on the first incorrect access — wait until there are, say, ten incorrect accesses in a minute.