The communication control apparatus (10) performs a receiving process, a counting process, and a determination process. The receiving process is a process for receiving a request packet to query a predetermined server. The counting process is a process for counting, based on a source address of the request packet, in multiple stages corresponding to different ranges of address areas that include the source address. The determination process is a process for determining an address area corresponding to a stage, from the multiple stage, in which a count value by the counting process exceeds a predetermined threshold value as an unauthorized access address area.