查看哪个IP访问量大,访问了什么地址,大可以看到攻击者IP: select c-ip,count(c-ip) AS allcount,cs-uri-stem,cs-uri-query,cs(User-Agent) from#IISW3C# WHERE to_string(date,'yyyy-MM-dd') = '2011-11-15' groupby c-ip,cs-uri-stem,cs-uri-query,cs(User-Agent) order by allcount desc 分析II…