[dangermouse]

that is true....modern web apps have counter measures installed for stopping brute forcing....

That said, there's so many that don't and that's where this comes to good use.

I've been assessing, Identifying vulnerabilities, and exploiting them via various attack vectors for a long time and the Insecurity of websites Is nothing short of appalling. I can confidently say that your methodology here will work more so than not.

How are you identifying which websites have account lockouts? Just manually trying the website?