Blocking invalid logins

[webman04]

Hey all,
I'm running a webserver on Windows Server 2003, (no firewall yet, but looking at them). Problem is, I get hit regularly with people trying to login with the default Administrator account (which I've changed to another name) and other names (spanish in origion, but they don't exist on the server).
While none have gotten in, is there a way to block these attacks? I understand that it's harming the attacker more than I when they run scans and don't get any results, but it is also using resources on my server (to try and verify the accounts), not to mention the log files filing quickly and having to backup and empty them almost daily.
Any advice would be appreciated. If you need more info, please ask.

Running Windows Server 2003
IIS 6
~60 different sites with different IP's

Thanks for the help.

 

[rn4it]

If you have control over your internet router or if you have a Layer3 switch that your internet router connects into as well your webserver. You could put a ACL(Access Control List) Basically, block anything coming to your webserver except http and https traffic and or ftp if you use it. Allow any from a trusted internal network that you would use. Firewall evolution is basically, filter routers, proxy servers, stateful inspection firewalls.