less access_log | awk '{print $1}' | sort | uniq -c | sort -nk1,1
ufw insert 1 deny from IPADDR comment 'ddos'