title: Tomcat 7 security - attempt to login?
body: <p>After deploying our app on Tomcat 7 we got lots of this:</p>
  
  <pre><code>&lt;date&gt; org.apache.catalina.realm.LockOutRealm authenticate
  WARNING: An attempt was made to authenticate the locked user "admin"
  </code></pre>
  
  <p>and in the access log we have found <em>lots</em> of this:</p>
  
  <pre><code>91.121.4.141 - - &lt;date&gt; "GET /manager/html HTTP/1.1" 401 2486
  </code></pre>
  
  <p>that seems a france ISP (OVH SAS).</p>
  
  <p>So.. what's going on? Are they try to log, ping? Is it a botnet?</p>
  
  <p>How can we protect from this attempts to login?</p>