Muhahaha, it seem my ~80 lines of #awk nono tool to ban suspicious IP works great : https://clbin.com/b55nP . See here for nono : https://si3t.ch/w/doku.php?id=code:nono.awk