iptables -N badguys
 iptables -A badguys -p tcp --dport 80 -m recent --set --name badlist -j LOG --log-prefix Adding to the badlist
 iptables -N block
 iptables -I INPUT ! -i lo -p tcp --dport 80 -j block
 iptables -I bam -p tcp --syn --dport 80 -m recent --name badlist --update --seconds 600 -j DROP
 iptables -I badguys -p tcp --dport 80 -m recent --name goodguys --update --rsource -j RETURN
 iptables -A bam -p tcp --dport 80 -m string --algo bm --string ofeliafeliz -j badguys
 iptables -I badguys -m limit --limit 10/s --limit-burst 10 -j RETURN

juancho@juancho-laptop:~$ curl -I -L http://www.lanacion.com
 HTTP/1.1 301 Moved Permanently
 Content-Length: 150
 Content-Type: text/html; charset=UTF-8
 Location: http://www.lanacion.com.ar/
 Server: Microsoft-IIS/7.5
 X-ORI: w9
 X-Powered-By: ASP.NET
 Date: Thu, 28 Feb 2013 21:01:46 GMT
 Connection: close
HTTP/1.1 200 OK
 Cache-Control: public, must-revalidate, max-age=900
 Content-Type: text/html
 Last-Modified: Thu, 28 Feb 2013 20:56:02 GMT
 Vary: Accept-Encoding
 Response-Flush: No
 X-ORI: w1
 X-Powered-By: ASP.NET
 Date: Thu, 28 Feb 2013 21:02:12 GMT
 X-Varnish: 3357640651 3357411539
 Age: 368
 Via: 1.1 varnish
 Connection: keep-alive
 X-CAMINO: UA_BOTS
 X-Cache: HIT 1653
 X-EPV: v8

• -I : when used, CURL prints only the server response’s HTTP headers, instead of the page data.
• -L : if the initial web server response indicates that the requested page has moved to a new location (redirect), CURL’s default behaviour is not to request the page at that new location, but just print the HTTP error message. This switch instructs CURL to make another request asking for the page at the new location whenever the web server returns a 3xx HTTP code.

juancho@juancho-laptop:~$ log="/root/domlogs_list"; dir="/usr/local/apache/domlogs"; > $log; num=$(find $dir -type f -name "*_log" | wc -l); echo "There are $num log files."; read -p "How many do you want outputted?: " howmany; read -p "How many IPs per domain would you like listed? " perdomain; echo $(date) | tee -a $log; find $dir -maxdepth 1 -mindepth 1 -type f ! -name "*_log" -exec bash -c "grep -cH "$(date +%d)\/$(date +%b)" {}" -print \; | sort -t\: -k 2 -rnu | sed 's/\(.*\)\:\([[:digit:]]\+\)/\2 \1/' | head -n $howmany | awk '{print $2}' | while read domain; do echo "----------------------------------------------------------------" | tee -a $log; echo $domain | tee -a $log; echo -e "# of requests\t\tIP address\t\tDomain name (if available)" | tee -a $log; grep "$(date +%d)\/$(date +%b)" $domain | awk '{print $1}' | sort | uniq -c | sort -rn | head -n $perdomain | awk '{print $1 " " $2}' | while read num ip; do rev=$(dig -x $ip +short); echo -e "$num\t\t$ip\t\t$rev" | tee -a $log; done; done
There are XX log files.
 How many do you want outputted?: 1
 How many IPs per domain would you like listed? 1
 Tue Feb 26 10:42:21 ART 2013
 ----------------------------------------------------------------
 /usr/local/apache/domlogs/xxx.com
 # of requests IP address Domain name (if available)
 8505 66.249.73.23 crawl-66-249-73-23.googlebot.com.
 971 65.55.24.214 msnbot-65-55-24-214.search.msn.com.
 605 201.231.198.85 85-198-231-201.fibertel.com.ar.
 513 65.55.52.117 msnbot-65-55-52-117.search.msn.com.
 503 157.55.32.144 msnbot-157-55-32-144.search.msn.com.
 492 157.55.36.50 msnbot-157-55-36-50.search.msn.com.
 484 157.55.32.95 msnbot-157-55-32-95.search.msn.com.