suspected ip detecting in a log file