What the log analyzer does
Paste any server log into the box above and Uplink Trace extracts every IPv4 and IPv6 address it can find, deduplicates them, and ranks the result by how often each address appears. Each unique address is then enriched from public data: the operating network (ASN and AS name from the regional registries), an approximate region from the DB-IP Lite dataset with an honest confidence rating, and a heuristic flag when the AS operator name suggests a datacenter, hosting provider, or VPN range. That flag reads LIKELY because an operator name is evidence, not proof.
There is no agent to install and no format to configure. Extraction is a single pass over the raw text — Ctrl+V and run — so timestamps, request paths, and everything else on the line are simply ignored.
What you can paste
Anything that is text. The analyzer was built with these in mind:
- Web access logs — nginx and Apache combined or common formats, CDN and load-balancer logs.
- Authentication logs — auth.log, sshd failure lines, fail2ban output.
- Firewall exports — iptables and nftables logs, pf output, Windows Firewall CSV, router syslog.
- Everything else — mail headers, application traces, a column copied out of a spreadsheet. If an address is in the text, it will be found.
If you already hold a clean list of addresses rather than raw logs, the bulk IP lookup takes one address per line and skips the extraction step.
Triaging suspicious traffic
- Sort by hits. Brute-force attempts and scrapers concentrate: a handful of addresses usually generates most of the noise, while legitimate users sit in the long tail.
- Check the obfuscation flags. Repeated failed logins from a range flagged LIKELY datacenter or LIKELY VPN is a different story from the same pattern on residential broadband. Read how accurate IP geolocation is before leaning on the map pins — country-level placement is reliable, city-level often is not, and mobile or VPN traffic is frequently misplaced.
- Drill into the top offenders. Every address links to a full dossier — reverse DNS, AS details, registrant, and the geolocation confidence breakdown — in the same format as this example trace.
- Pivot to the network. When several noisy addresses share an AS, the ASN lookup shows who operates the entire range, which is often the fastest route to one firewall rule instead of fifty.
One caution bears repeating: IP geolocation places networks, not people. An address in your log resolves to a probable area and an operating network; it cannot identify an individual, a household, or a street address.
What happens to pasted logs
Pasted logs are processed in memory for the duration of the request and are not stored, indexed, or reused. Extracted addresses are matched against local copies of public datasets, so the content of your log never leaves the analysis pipeline. The full details are in the privacy policy.