I want to block requests from bots that attempt to brute force login to my website.

I'm using `Session` to store login attempts, and I show a Captcha after three unsuccessful logins. However, the problem is that `Session` is removed once the user closes the browser.

What kind of solution should I consider to prevent bots and brute force login attempts? What property of the user system or browser should I use to manage his/her next login?

Note: I don't use an ASP.NET Membership provider. I am using my own authentication and authorization classes.