Top IP Addresses Extractor

Who is talking to you the most? Top IP Extractor scans any access, firewall or auth log, counts every IP address it finds, and ranks them by hit count — instantly surfacing scanners, bots, misbehaving clients, and your heaviest legitimate traffic sources in one list.

Extraction covers both address families in a single pass. Every dotted-quad IPv4 pattern in a line is checked against a real range (each octet must be 0–255, so version strings and other four-number sequences that merely look like an IP are excluded), and every colon-separated token that contains a double-colon compression (::) and looks like a valid IPv6 group count is picked up too — so a mixed IPv4/IPv6 log, common on any dual-stack server, is ranked as one combined list rather than two separate ones you’d have to merge by hand.

The ranking itself is a simple but powerful idea: count occurrences per address, sort descending, and show each entry’s share of total hits as a percentage. That percentage is what turns a raw count into a signal — an IP with 40 hits out of 40,000 total requests is unremarkable, but the same 40 hits out of 60 total requests means that one address is responsible for two-thirds of everything in the window, which is exactly the kind of concentration that flags a scanner, a broken retry loop, or a single power user worth understanding before you scale.

• Ranked list — every distinct IP counted and sorted by hit count, highest first.
• Top-N selector — show the top 10, 25 or 50 without scrolling through the long tail.
• Share percentages — each IP’s hits as a percentage of total matched hits, so concentration is visible at a glance.
• IPv4 + IPv6 in one pass — dotted-quad and colon-compressed addresses are both recognized and ranked together.
• Copyable ranking — the full list with counts and percentages, ready to paste into a report or ticket.

1. Paste access, firewall, or auth log lines — any format where an IP address appears somewhere in each line works.
2. Choose how many top entries to show — 10 for a quick check, 50 for a deeper audit.
3. Click Extract top IPs. The ranked list appears with counts and percentage share, plus summary stats (total hits, distinct IPs, top share).
4. Copy the ranking to attach to a firewall rule request, abuse report, or capacity review.

Example 1 — Scanner triage. A bot hammering /wp-login.php from a single subnet floods the log with repeat hits from the same handful of addresses; those addresses jump straight to the top of the ranking with a visibly outsized percentage, making them easy to block.

Example 2 — Vendor and client audit. Your uptime monitor, CDN health-checker, or internal load balancer should appear near the top predictably and at a stable share — if an unfamiliar address shows up with a similar pattern, it deserves a second look.

Example 3 — Capacity planning. If one client IP is responsible for half your requests, that changes how you think about rate limiting, caching, and whether "average load" is even a meaningful number for your service.

Example 4 — Dual-stack traffic. A log with both IPv4 and IPv6 clients (increasingly common) is ranked as a single combined list, so an IPv6 scanner does not slip under the radar just because it looks different from the IPv4 entries around it.

• Instant attention map — the addresses worth investigating rise to the top automatically.
• Share-aware — percentages turn raw counts into a meaningful signal of concentration.
• Flexible depth — dial the list from a quick top-10 glance to a 50-entry audit.
• Dual-stack ready — IPv4 and IPv6 addresses are extracted and ranked together.
• Private — extraction and ranking run entirely client-side; nothing is uploaded.