how about http://forum.mikrotik.com/t/block-brute-force-via-firewall-scripting-unto-various-mikrot/15763/1