To find out what IP addresses are most active in accessing your webistes, just execute this line against Apache access log.
awk '{print $1}' access_log | sort | uniq -c | sort -n | tail -20 | awk '{print $2,$2,$1}' | logresolve | awk '{printf "%6d %s (%s)\n",$3,$1,$2}'
where access_log is filename for Apache access log file, and -20 means that I want to see a first 20 addresses. Great resource of information can be found at the-art-of-web.com.