SELECT ip, agent, COUNT(*) as visits
FROM access
WHERE bot IS NULL
AND agent LIKE '%bot%'
GROUP BY ip, agent
ORDER BY visits DESC
SELECT ip, agent, COUNT(*) as visits
FROM access
WHERE bot IS NULL
AND ip NOT IN (SELECT ip FROM blocked)
GROUP BY ip, agent
HAVING visits > 1000
ORDER BY visits DESC
SELECT CONCAT('deny from ', ip)
FROM blocked
ORDER BY ip