irule Brute Force attack control on SFTP Virtual servers

i would expect an irule to do that already exists but i can't find anything.

you will probably need to combine some existing irules.

the one you suggest + something like this: https://devcentral.f5.com/articles/preventing-brute-force-password-guessing-attacks-with-apm%E2%80%93part-4 and ignore the APM parts.

you would create a table with all client IPs and a connection counter, do a counter+1 when an IP makes a connection. then when it reaches some limit block it for an hour and clear the counter.