Suspicious IP Checker

A single suspicious source is rarely the story — the story is which addresses on your blocklist show up in your logs. Suspicious IP Checker reads two inputs: the log or IP list you want to audit, and a paste of known-bad addresses — a threat feed, firewall export, or SIEM blocklist. It extracts every IPv4 address from the first box using a word-boundary-aware pattern so it never picks up a stray fragment out of a longer number, validates each octet against the 0-255 range, resolves CIDR ranges in the second box into exact numeric address windows, and flags every log line that contains a hit.

CIDR handling is exact integer-range math, not string matching: a bad-list entry like 203.0.113.0/24 is converted to its base address and expanded into the correct 256-address window, and any IP anywhere inside that window matches even though its text never appears verbatim on your blocklist. Results are grouped by the blocklist entry that matched — a single IP or an entire range — listing how many times it appeared in your data, the individual addresses that hit within a range, and the count of distinct original log lines involved. Tune matching with an optional minimum-hits threshold so one stray, easily-explained hit stays quiet while a repeated offender jumps out immediately.

• Paste-and-compare workflow — your log or IP list against a pasted blocklist, no accounts or uploads.
• CIDR range support — 192.0.2.0/24 style entries are expanded to exact address ranges, including edge prefixes like /0 and /32.
• Validated IPv4 extraction — every candidate is checked octet-by-octet (0-255) before it is treated as a real address.
• IPv4 extraction from full lines — context such as timestamps, paths, and status codes stays attached to every match.
• Per-IP hit counts and line reports — see exactly how often and where each address appeared.
• Accurate flagged-line count — the summary reflects the number of distinct original log lines a match came from, not a text-scan artifact of the report.
• Minimum-hits threshold — filter out single incidental hits and focus on repeat offenders.
• Local only — no upload, ever; both your log and your blocklist stay in the browser.

1. Paste your log or IP list into the first box — access logs, auth logs, firewall logs, or a bare list of addresses.
2. Paste known-bad addresses into the second box — one per line, either plain IPv4 addresses or CIDR ranges such as 203.0.113.0/24.
3. Set the minimum hits to flag if you want to suppress single incidental matches; leave it at 1 to see everything.
4. Click Check IPs. Every IPv4 in your data is validated and compared against every entry in the blocklist, including CIDR expansion.
5. Read the summary cards — distinct IPs seen, valid blocklist entries, how many entries matched, and how many original log lines were involved.
6. Review the grouped report, organized by blocklist entry, then copy it for the SOC or your incident ticket.

Example 1 — Firewall blocklist. You export 500 ranges from your firewall’s threat feed. Scanning the last week of access logs flags the 4 addresses that actually showed up, each with the original log lines for context.

Example 2 — SIEM watchlist. Your SOC shares a watchlist of 20 VIP-targeting addresses. The checker confirms two are present in today’s SSH logs and shows exactly which lines and how many times.

Example 3 — Range collapses. A /24 block that owns a scanner shows up as one grouped entry with dozens of hits across several distinct addresses inside that range, instead of a wall of unrelated-looking single IPs that would be easy to miss individually.

Example 4 — Threshold tuning. A blocklist entry hits your log exactly once, from an address that also shows up in your own monitoring allowlist for unrelated reasons. Setting minimum hits to 2 or 3 keeps that kind of one-off noise out of the report while a genuinely repeated address, appearing across many separate lines, still surfaces clearly with an accurate count of how many distinct lines it touched.

• Instant correlation — your data checked against your own threat intel, with no external lookups.
• CIDR-aware matching — subnets are handled with exact address-range math, not approximate string matching.
• Context preserved — flagged results keep the original log line, so the story around each hit is never lost.
• Grouped output — one entry per bad address or range, with counts, instead of a flat unsorted list.
• Trustworthy summary numbers — the flagged-line count matches what is actually in the report, line for line.
• Private — nothing leaves the browser; both the log and the blocklist are sensitive and stay local.