example of using a join to look for offending ips