extract malicious IP