This morning one of our sites got attacked by a bot that was looking for vulnerabilities. The same IP address was used. However the BOT only made on average 12-16 page requests a minute. Different pages were hit that have 20-40 static resources made up of images, css, js etc.
Armed with this knowledge what is a good strategy in enabling Dynamic IP Restrictions on IIS7.5? I can see I can enable "logging only mode" but am not entirely sure how to best look at the log files to solve this problem.
What I don't want to do is to lock out my users but abort the request for BOTs.