Log analyzer
Paste or upload logs from any source (web server, SSH, firewall, mail, Windows, JSON or CSV) and see how much of that traffic came from known malicious IP addresses.
Limits per analysis
| Log size | Addresses checked | |
|---|---|---|
| Anonymous | 256 KB | 100 |
| Free account | 2 MB | 1,000 |
| Enterprise | 5 MB | 10,000 |
The busiest addresses are checked first. Each one counts as one lookup against your daily allowance. The same analysis is available to AI assistants as the analyze_logs tool of the MCP server.
Questions
Which log formats does the analyzer understand?
Any text log. It finds IPv4 and IPv6 addresses wherever they are in a line, so web server access logs (nginx, Apache, IIS), sshd and syslog, firewall logs (iptables, UFW, pfSense, Cisco ASA), mail servers, Windows events exported to text, CEF, JSON lines from a SIEM or cloud provider, and CSV exports all work. Each non-blank line counts as one event.
How much can I analyze?
Without an account, 256 KB of log and the 100 busiest addresses in it. With a free account, 2 MB and 1,000 addresses. Enterprise, 5 MB and 10,000 addresses. Each address looked up counts as one lookup against your daily allowance.
Do you keep my logs?
No. The log is analyzed in memory while the page loads and then thrown away. It is not stored, logged or used to report anyone. Still, remove anything you would not want to send to a third party, such as passwords or session tokens in URLs.
What counts as a malicious event?
An event is malicious when an address in it has a confidence score of 75 or more, which is the threshold for the blocklist. Scores from 25 to 74 count as suspicious. A score of 0 only means nobody has reported the address recently.