LoginThrottler  

Limits failed logins, so passwords can't be guessed at full speed.

Failures are counted twice: for one username or email from one IP address, which stops guessing at one account, and for the IP address alone, which stops trying a few passwords against many accounts. Neither is counted for an account alone, so nobody can lock someone else out by failing to log in as them. Failures are recorded by the RecordFailedLogins middleware, whichever controller handles the route.