 				<cfset lastTime=thisTime>
 			</cfloop>
 			<cfif nrq gt numberOfQueries>
-				<cfset maybeBad=listappend(maybeBad,'#ip#|#nrq#',",")>
+				<cfset cfrt=nrq/thisRequests.recordcount>
+				<cfif cfrt gt floodRatio>
+					<cfset maybeBad=listappend(maybeBad,'#ip#|#nrq#|#cfrt#',",")>
+				</cfif>
 			</cfif>
 		</cfif>
 	</cfif>
 </cfloop>
 
-mailing to #application.logemail#....
-
-	<cfloop list="#maybeBad#" index="o" delimiters=",">
-		<cfset thisIP=listgetat(o,1,"|")>
-		<cfset cfcnt=listgetat(o,2,"|")>
-		<p>IP #thisIP# made #cfcnt# flood-like requests in the last #numberOfRequests# overall requests.</p>
-
-		<a href="http://whatismyipaddress.com/ip/#thisIP#">[ lookup #thisIP# @whatismyipaddress ]</a>
-		<br><a href="https://www.ipalyzer.com/#thisIP#">[ lookup #thisIP# @ipalyzer ]</a>
-		<br><a href="https://gwhois.org/#thisIP#">[ lookup #thisIP# @gwhois ]</a>
-		<p>
-			<a href="#Application.serverRootURL#/Admin/blacklist.cfm?action=ins&ip=#thisIP#">[ blacklist #thisIP# ]</a>
-			<br><a href="#Application.serverRootURL#/Admin/blacklist.cfm?ipstartswith=#thisIP#">[ manage IP and subnet restrictions ]</a>
-		</p>
-		<cfquery name="thisIPR" dbtype="query">
-			select * from x where ip='#thisIP#' order by ts
-		</cfquery>
-		<cfloop query="thisIPR">
-			<br>#usrname#|#ts#|#rqst#|#ip#
-		</cfloop>
-	</cfloop>
 
 
-<!----
 <cfmail to="#application.logemail#" subject="click flood detection" from="clickflood@#Application.fromEmail#" type="html">
 	<cfloop list="#maybeBad#" index="o" delimiters=",">
 		<cfset thisIP=listgetat(o,1,"|")>
 		<cfset cfcnt=listgetat(o,2,"|")>
-		<p>IP #thisIP# made #cfcnt# flood-like requests in the last 5000 overall requests.</p>
-
+		<cfset cfrt=listgetat(o,3,"|")>
+		<p>IP #thisIP# made #cfcnt# flood-like requests (#cfrt# flood ratio) in the last #numberOfRequests# overall requests.</p>
+		<cftry>
+			<cfhttp url="freegeoip.net/json/#thisIP#" timeout="5"></cfhttp>
+			<cfset remIPInfo=DeserializeJSON(cfhttp.fileContent)>
+			<br>#remIPInfo.country_name# #remIPInfo.region_name# #remIPInfo.city#
+		<cfcatch><br>ip info lookup failed</cfcatch>
+		</cftry>
 		<br><a href="http://whatismyipaddress.com/ip/#thisIP#">[ lookup #thisIP# @whatismyipaddress ]</a>
 		<br><a href="https://www.ipalyzer.com/#thisIP#">[ lookup #thisIP# @ipalyzer ]</a>
 		<br><a href="https://gwhois.org/#thisIP#">[ lookup #thisIP# @gwhois ]</a>

	select distinct(ip) from x
</cfquery>


<cfset maybeBad="">

<cfset timeBetweenQueries=3>
<cfset numberOfQueries=10>
<cfset utilities = CreateObject("component","component.utilities")>

<cfloop query="dip">
<hr>
	<br>running for #ip#
	<cfif utilities.isProtectedIp(request.ipaddress) is false>

		<cfquery name="thisRequests" dbtype="query">
			select * from x where ip='#ip#' order by ts
		</cfquery>

<cfquery name="x" dbtype="query">
	select * from x where rqst not like '%/form/%'
</cfquery>
<cfquery name="x" dbtype="query">
	select * from x where rqst not like '%/includes/%'
</cfquery>
