Are the IPs hitting your firewall already known?
Paste up to 50 IP addresses, or raw lines from your firewall logs. Our analysts check them against intelligence from 290+ alliance members and email you the Crime Score of each one, with the ones worth blocking flagged.
How it works
Your logs stay in your browser
- IPs are extracted in your browser. Private and reserved addresses (10.x, 192.168.x, etc.) and the rest of your log lines are never sent.
- We check each IP against the alliance and its 0–1000 Crime Score.
- You get the results by email, usually within 24 hours.
- Free, no sign-up.
In the PHP2Shell attack burst, 25 of the 27 attacking IPs were already scored by OneFirewall before it began.
Read the briefing →Request received.
We’ll email the Crime Scores for your IPs, usually within 24 hours. Want the full picture? A free Proof of Value checks every connection your firewall allowed over 10 days, not just a sample.
Crime Score
What the score tells you
| Range | Band | Recommended action |
|---|---|---|
| 0–80 | Clean / Unobserved | No enforcement action recommended |
| 80–140 | Watchlist / Monitor | Logging and alerting only |
| 140–250 | Block Recommended | Start at ≥400 for a safe initial deployment, then lower toward 190 |
| 250–1000 | Immediate Block | High-confidence, multi-sector confirmed |