 	select distinct(ip) from x
 </cfquery>
 
-
-<cfset maybeBad="">
-
-<cfset timeBetweenQueries=3>
-<cfset numberOfQueries=10>
-<cfset utilities = CreateObject("component","component.utilities")>
-
 <cfloop query="dip">
-<hr>
-	<br>running for #ip#
-	<cfif utilities.isProtectedIp(request.ipaddress) is false>
-
+	<!--- ignore protected IPs; they have explicit permission presumably because they are not disruptive ---->
+	<cfif utilities.isProtectedIp(ip) is false>
 		<cfquery name="thisRequests" dbtype="query">
 			select * from x where ip='#ip#' order by ts
 		</cfquery>


	    <!--- Define arguments. --->
	    <cfargument
	    name="Date"
	    type="string"
	    required="true"
	    hint="ISO 8601 date/time stamp."
	    />

	    <!---
	    When returning the converted date/time stamp,
	    allow for optional dashes.
	    --->
	    <cfreturn ARGUMENTS.Date.ReplaceFirst(
	    "^.*?(\d{4})-?(\d{2})-?(\d{2})T([\d:]+).*$",
	    "$1-$2-$3 $4"
	    ) />
</cffunction>

<cfset numberOfRequests=50000>
<cfexecute
	 timeout="10"
	 name = "/usr/bin/tail"
	 errorVariable="errorOut"
	 variable="exrslt"
	 arguments = "-#numberOfRequests# #Application.requestlog#" />

<cfset x=queryNew("ts,ip,rqst,usrname")>
<cfloop list="#exrslt#" delimiters="#chr(10)#" index="i">
	<cfset t=listgetat(i,1,"|","yes")>

				<cfset lastTime=thisTime>
			</cfloop>
			<cfif nrq gt numberOfQueries>
				<cfset cfrt=nrq/thisRequests.recordcount>
				<cfif cfrt gt floodRatio>
					<cfset maybeBad=listappend(maybeBad,'#ip#|#nrq#|#cfrt#',",")>
				</cfif>
			</cfif>
		</cfif>
	</cfif>
</cfloop>



<cfmail to="#application.logemail#" subject="click flood detection" from="clickflood@#Application.fromEmail#" type="html">
	<cfloop list="#maybeBad#" index="o" delimiters=",">
		<cfset thisIP=listgetat(o,1,"|")>
		<cfset cfcnt=listgetat(o,2,"|")>
		<cfset cfrt=listgetat(o,3,"|")>
		<p>IP #thisIP# made #cfcnt# flood-like requests (#cfrt# flood ratio) in the last #numberOfRequests# overall requests.</p>
		<cftry>
			<cfhttp url="freegeoip.net/json/#thisIP#" timeout="5"></cfhttp>
			<cfset remIPInfo=DeserializeJSON(cfhttp.fileContent)>
			<br>#remIPInfo.country_name# #remIPInfo.region_name# #remIPInfo.city#
		<cfcatch><br>ip info lookup failed</cfcatch>
		</cftry>
		<br><a href="http://whatismyipaddress.com/ip/#thisIP#">[ lookup #thisIP# @whatismyipaddress ]</a>
		<br><a href="https://www.ipalyzer.com/#thisIP#">[ lookup #thisIP# @ipalyzer ]</a>
		<br><a href="https://gwhois.org/#thisIP#">[ lookup #thisIP# @gwhois ]</a>
