Read a Server Log and Point at the Attacks SENTRY
The evidence of an attack is usually in a log nobody has time to read. This reads it in the browser, groups it by source, and points at the brute force, the scanning and the requests carrying a payload.
The log
Drop a log file here, or open one
auth.log / secure, or an Apache/nginx access log. Nothing is uploaded.
What stands out
How to read this
Addresses are ordered worst first: a login after failures and requests carrying a payload sit above raw scanning. It reads volume and signature, not intent, so confirm before blocking - a busy legitimate client can look like a scanner, and a slow attack can stay under the line. Export the list to feed a block list, and keep the raw log with CHAIN if it may be evidence.