Hi. I run a website where people login using OpenID. And sometimes my DOS protection triggers a warning because of too many similar requests from the same IP. It works for 99.99% of the users, but a few users trigger the system. I investigated that further and did a server logfile extract on the calling IP.
Please have a look. The /?p=connect lines are for a normal connect after the OpenID server successfully redirected the user. At first, I expect there to be one. But here it was 4 times. And also, why does the browser do so many request on the root (/)? Is there something wrong in my page that triggers such? And why only for a few users?
I would love to get some hints about to reproduce such behavior and about the possible reasons.
Hint: There is one 403 code at the bottom, which was after the DOS protction system identified this as an attack.