thanks brash for the feedback.

i have used the standard watch time and bad count: 60s and 10.

should it be sufficient in most of the cases?

i'm lost, how can i determine it is a true crawler/not real DoS? there are basically 2 ip in the log (always a pair, crawler and dos): when is check through the link you provided: it is from Universitaet Hohenheim, Stuttgart, Germany and the other one is from iana.org. how can i tell it is a true crawler & not dos?

i do not want to block the ip, then some members of my website can't access my website anymore?

appreciate your help. thanks. (and sorry for the stupid question)