log only bad IPs that are predefined