How to Identify Malicious IP Connections