Take list of IPs from graylog2 and identify threatening subnets by frequency of hits