1

We got Tomcat that needs to be restarted quite often on our production. Examining Apache access log file, I can see that certain IP addresses are hitting same logon page hundreds of times one after another:

    123.45.6.789 - - [17/Feb/2016:12:17:05 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:05 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:05 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:06 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:06 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:06 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:06 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:07 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:07 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:08 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -        123.45.6.789 - - [17/Feb/2016:12:17:08 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:08 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -        123.45.6.789 - - [17/Feb/2016:12:17:08 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:09 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -        123.45.6.789 - - [17/Feb/2016:12:17:09 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:10 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:10 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -        123.45.6.789 - - [17/Feb/2016:12:17:10 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:10 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:11 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:11 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:12 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:12 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:12 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:12 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:13 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:13 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:14 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:14 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:14 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:14 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:15 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:15 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:16 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:16 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:16 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:16 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:17 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:17 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:18 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:18 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:18 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:18 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:19 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:19 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:20 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:20 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:20 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:20 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:21 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:21 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:22 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:22 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:22 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:22 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:23 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:23 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:23 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:24 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:24 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:24 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:25 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:25 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:25 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:26 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:26 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:26 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:27 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:27 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:27 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:28 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:28 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:28 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:29 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:29 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:29 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:30 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:30 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:30 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:31 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:31 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:31 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:32 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:32 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:32 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:33 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:33 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:33 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:34 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:34 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:34 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:35 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:35 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:35 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:36 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:36 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:36 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:37 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:37 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:37 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:37 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:38 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:38 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:39 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:39 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:39 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:39 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:40 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:40 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:41 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:41 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:41 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:41 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:42 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:42 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:43 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:43 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:43 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:43 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:44 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:44 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:45 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:45 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:45 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:45 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:46 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:46 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:47 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:47 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:47 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:47 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:48 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:48 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:49 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:49 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:49 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:49 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:50 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:50 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:51 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:51 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:51 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:51 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:52 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:52 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:52 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:53 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:53 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:53 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:54 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:54 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:54 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:55 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:55 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:55 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:56 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:56 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:56 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:57 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:57 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:57 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:58 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:58 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:58 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:59 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:59 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:17:59 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:00 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:00 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:00 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:01 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:01 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:01 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:02 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:02 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:02 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:03 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:03 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:03 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:04 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:04 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:04 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:04 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:05 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:05 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:06 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:06 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:06 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:06 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:07 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:07 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:08 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:08 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:08 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:08 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:09 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:09 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:10 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:10 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:10 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:10 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:11 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:11 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:12 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:12 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:12 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:12 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:13 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:13 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:14 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:14 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:14 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:14 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:15 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:15 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:15 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:16 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:16 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:16 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:17 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:17 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:17 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:18 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:18 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:18 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:19 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:19 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:19 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:20 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:20 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:20 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:21 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:21 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:21 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:22 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:22 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:22 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:23 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:23 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:23 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:24 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:24 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:24 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:25 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:25 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:26 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:26 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:26 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:27 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:27 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:27 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:28 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:28 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:28 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:29 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:29 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:29 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:30 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:30 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:30 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:31 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:31 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:31 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:32 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:32 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:32 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:33 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:33 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:33 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:34 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:34 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:34 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:34 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:35 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:35 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:36 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:36 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:36 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:36 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:37 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:37 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:38 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:38 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:38 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:38 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:39 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:39 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:40 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:40 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:40 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:40 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:41 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:41 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:42 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:42 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:42 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:42 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:43 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:43 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:44 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:44 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:44 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:44 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:45 -0500] "GET /da8/logon.jsf HTTP/1.1" 302 -
    123.45.6.789 - - [17/Feb/2016:12:18:45 -0500] "POST /da8/jsp/preLogon.jsf;jsessionid=6B28DE2D7BB9FB594C40FE3312211F8E HTTP/1.1" 302 -

Is there a way on Windows to prevent the same IP address from hiting this same page all over?

While reading "How does slowloris http dos attack work", they mentioned that the request looks like this:

GET / HTTP/1.0

Checking my Apache's access log file, I found many of these kinds of requests:

131.22.33.75 - - [17/Feb/2016:00:23:44 -0500] "GET / HTTP/1.1" 302 239
131.22.33.75 - - [17/Feb/2016:00:41:51 -0500] "GET / HTTP/1.1" 302 239
123.4.37.68 - - [17/Feb/2016:06:44:31 -0500] "GET / HTTP/1.1" 302 239
131.11.22.244 - - [17/Feb/2016:07:05:03 -0500] "GET / HTTP/1.1" 302 239
131.11.22.244 - - [17/Feb/2016:07:14:09 -0500] "GET / HTTP/1.1" 302 239
131.11.22.244 - - [17/Feb/2016:07:16:11 -0500] "GET / HTTP/1.1" 302 239
131.11.22.244 - - [17/Feb/2016:07:17:12 -0500] "GET / HTTP/1.1" 302 239
164.87.1.140 - - [17/Feb/2016:07:18:54 -0500] "GET / HTTP/1.1" 302 239
131.70.61.39 - - [17/Feb/2016:07:35:46 -0500] "GET / HTTP/1.1" 302 239
131.70.65.77 - - [17/Feb/2016:07:52:27 -0500] "GET / HTTP/1.1" 302 239
131.70.65.77 - - [17/Feb/2016:08:01:48 -0500] "GET / HTTP/1.1" 302 239
164.87.2.130 - - [17/Feb/2016:08:06:07 -0500] "GET / HTTP/1.1" 302 239
131.70.104.253 - - [17/Feb/2016:08:23:28 -0500] "GET / HTTP/1.1" 302 239
131.70.56.116 - - [17/Feb/2016:08:24:21 -0500] "GET / HTTP/1.1" 302 239
123.4.37.68 - - [17/Feb/2016:08:47:15 -0500] "GET / HTTP/1.1" 302 239
123.4.57.68 - - [17/Feb/2016:08:58:46 -0500] "GET / HTTP/1.1" 302 239
123.4.49.68 - - [17/Feb/2016:09:09:21 -0500] "GET / HTTP/1.1" 302 239
131.70.65.8 - - [17/Feb/2016:09:11:29 -0500] "GET / HTTP/1.1" 302 239
206.38.34.43 - - [17/Feb/2016:09:16:03 -0500] "GET / HTTP/1.1" 302 239
131.70.65.77 - - [17/Feb/2016:09:31:52 -0500] "GET / HTTP/1.1" 302 239
123.4.49.68 - - [17/Feb/2016:09:48:12 -0500] "GET / HTTP/1.1" 302 239

Is this legit and I found it odd that the same process was being used...

Angelina
  • 133
  • 6

1 Answers1

1

I suggest to do a quick google search, as similiar questions were asked many times before.

Mod_security is well suited for your problem:

SecRuleEngine On


  SecAction initcol:ip=%{REMOTE_ADDR},pass,nolog
  SecAction "phase:5,deprecatevar:ip.somepathcounter=1/1,pass,nolog"
  SecRule IP:SOMEPATHCOUNTER "@gt 20" "phase:2,pause:300,deny,status:509,setenv:RATELIMITED,skip:1,nolog"
  SecAction "phase:2,pass,setvar:ip.somepathcounter=+1,nolog"
  Header always set Retry-After "10" env=RATELIMITED


ErrorDocument 509 "Rate Limit Exceeded"

It's up to you to calculate appropriate limits to avoid false positives.

anx
  • 328
  • 1
  • 6