...partially. First, you can have a dynamic counter that reads the log lines as they come along, maintaining a count for 10 minutes back. If any address passes the threshold, it calls iptables to block that number - so Apache doesn't even have to deal with it, and it gets blocked at kernel level. Or use whatever firewall interface if you don't use iptables. Add the address to a list (say, in database) which lists the IP address and the time when it should be unblocked. Then have a cron job that calls iptables (or whatever) again for each of the IP addresses that needs to be released, and clears it from the database. Should all be pretty efficient, and apache is not involved at all.