An Attacker Is Testing Out the Login Page of a Website

Multiple Choice

An attacker is testing out the login page of a website. He notices that after 5 failed attempts he is redirected to a different page. He assumes this logs his IP address, and if this redirect continues, it could lead to being blocked.
How can he avoid this from happening?

A) He can turn on SSL support in his browser, that way the encrypted requests will be hidden from the
IDS
B) He can send his requests from random spoofed IPs so the server wouldn't think they are all coming from the same source
C) He can create a persistant cookie that tells the web server to ignore failed logins
D) If there is a hidden form field that stores the "retries" count, he can modify the source code to avoid the threshold