docs: @Override
    public final void trackLoginFail(
      final HttpServletRequest pReq) throws Exception {
      HttpSession session = pReq.getSession();
      Integer flCountAttempt = (Integer) session.getAttribute("flCountAttempt");
      if (flCountAttempt == null) {
        flCountAttempt = 0;
      }
      flCountAttempt++;
      session.setAttribute("flCountAttempt", flCountAttempt);
      if (flCountAttempt < 6) {
        pReq.setAttribute("loginErrorJsp",
          srvI18n.getMsg("invalid_user_name_or_password"));
        // scamware can make any headers, so user-agent is not informative
        String msg = "Fail login attempt from IP/port/host/attempt: "
          + pReq.getRemoteAddr() + "/" + pReq.getRemotePort()
            + "/" + pReq.getRemoteHost() + "/" + flCountAttempt;
        logger.warn(null, SessionTracker.class, msg);
      } else {
        // banned for web.xml session-timeout minits
        session.setAttribute("isBanned", Boolean.TRUE);
        pReq.setAttribute("loginBanJsp", this.srvI18n.getMsg("loginBan"));
        String msg = "Ban login attempt from IP/port/host/attempt: "
          + pReq.getRemoteAddr() + "/" + pReq.getRemotePort()
            + "/" + pReq.getRemoteHost() + "/" + flCountAttempt;
        logger.error(null, SessionTracker.class, msg);
      }
    }