Five hundred lines.
Which three addresses?
Paste log lines — any format — and this pulls out the IP addresses, counts how often each appears, and ranks them by which deserve your attention first. Tor exits and blocklisted addresses lead; ordinary residential traffic sinks. The point is to hand you a shortlist, not another table.
Corrections welcome — see our editorial policy.
What gets ranked first
The tiers describe how much attention an address deserves, not how guilty it is. Nothing here can tell you an address is malicious.
- Tor exit — the address is a current Tor exit node. Traffic through Tor is deliberately anonymised, so it says nothing about who sent it; the choice to use Tor is the part worth explaining.
- Blocklisted — the address appears on a curated public blocklist. That is somebody else's judgement, and listings go stale, so treat it as a lead.
- Hosting — the address belongs to a datacenter or VPN provider. A server, not a home connection. Completely ordinary for an API client or a crawler; distinctly odd in a log of human sign-ins.
- Residential — a consumer or business ISP. What ordinary user traffic looks like, and usually most of the list.
- Unknown — no geolocation or network data. A gap in the database, not a verdict.
How often an address appears never promotes it between tiers. One request from a Tor exit matters more than four thousand from a CDN, and a tool that sorts by volume just rediscovers your busiest client every time. The count orders addresses inside a tier, where it is genuinely useful.
Why the ASN grouping matters
Fourteen addresses from one hosting provider is one thing to investigate, not fourteen. Where several addresses share an operator, they are grouped and reported together — which is usually the fastest way to see that an apparently broad set of sources is really a single origin.
What this cannot tell you
- Blocklist checks are budgeted. Each one is a live DNS query, so only the top few addresses are checked and the result says which. An address with no blocklist result was not tested — that is not the same as clean.
- Private and reserved addresses are set aside. RFC 1918, loopback, link-local and CGNAT ranges describe nobody on the public internet. They are counted and reported separately rather than dropped, so the totals still add up.
- Geolocation is approximate, and a cloud or CDN address resolves to the provider rather than to whoever was using it. See how IP geolocation works.
- Nothing here knows your environment. Your own office egress will look like hosting infrastructure. Read the ranking, then apply what you know.
Common scenarios
“Brute-force attempts in the auth log.”
Paste the failed-login lines. Hosting-tier addresses near the top are the interesting ones: a residential address making a few attempts is often a real user with a stale password, while a datacenter address making hundreds is not a person at all.
“Which of these is worth a full report?”
That is the intended workflow. Rank here, then open the two or three that lead the list in IOC enrichment for the full picture — reverse DNS, the complete blocklist set, and per-source attribution.
“I just want the table.”
Then you want bulk IP lookup, which takes a list of addresses and returns geolocation and ASN for every one without ranking them. This tool exists for when the list is too long to read.