 	 variable="exrslt"
 	 arguments = "-#numberOfRequests# #Application.requestlog#" />
 <cfset x=queryNew("ts,ip,rqst,usrname")>
+
+<cfset firstRequestLine=listgetat(exrslt,1,"#chr(10)#")>
+<cfset firstRequestTime=listgetat(firstRequestLine,1,"|")>
+<cfset firstRequestTime=ISOToDateTime("#firstRequestTime#")>
+
 <cfloop list="#exrslt#" delimiters="#chr(10)#" index="i">
 	<cfset t=listgetat(i,1,"|","yes")>
 	<cfset ipa=listgetat(i,5,"|","yes")>

	We're averaging about 50K requests/day at realease - revisit when/if necessary
---->
<cfset numberOfRequests=50000>
<!----
	time between subsequent queries. E.g., queries 5s apart follow robots.txt and won't break anything;
	this is only intended to detect abuse which might lead to issues, not tolerable usage



<cfmail to="#application.logemail#" subject="click flood detection" from="clickflood@#Application.fromEmail#" type="html">
	<p>
		This is an automated message from /ScheduledTasks/clickflood.cfm
	</p>
	<p>
		The purpose of this application is to capture traffic which requests multiple pages in a short amount of time. This application
		is primarily designed to detect automated requests ("bots") which do not follow the directives in /robots.txt.
	</p>
	<p>
		The last #numberOfRequests# (variable: numberOfRequests) logs are analyzed. That should be about 24h of traffic.
		Actual: #firstRequestTime#-#now()#=#datediff('h',firstRequestTime,now())# hours.
	</p>
	<p>
		Queries which occur less than #timeBetweenQueries# (variable: timeBetweenQueries) seconds apart are counted.
	</p>
	<p>
		#numberOfQueries# (variable: numberOfQueries) events from an IP are necessary to trigger this email.
	</p>
	<p>
		IPs making fewer than #minQueries# (variable: minQueries) are ignored.
	</p>
	<p>
		#floodRatio# (variable: floodRatio) requests from an IP must meet all criteria here to trigger this;
		 IPs with low ratios of abusive requests will be ignored.
	</p>
	<p>
		This application ignores .cfc requests, local IP requests, requests for the /form/ and /includes/ directories, requests from signed-in
		users, and requests from protected IPs. (IPs may be protected in Global Settings.)
	</p>
	<p>
		All of the following should probably be blocked. Adjust variables as necessary, with the goal of auto-listing abusive traffic.
	</p>


	<cfloop list="#maybeBad#" index="o" delimiters=",">
		<cfset thisIP=listgetat(o,1,"|")>
		<cfset cfcnt=listgetat(o,2,"|")>
