correct $time_diff

analyse access.log to ban the source ip in cc