Android Intrusion Log Analyzer

Drop a .zip archive or log files to start

Reviewed: 0 / 0
+ + + +

Drop a .zip archive or log files

Upload an Android Intrusion Logging export (.zip or .txt files) to inspect network traffic, DNS queries, app processes, and security events. Everything runs in your browser.

Event Breakdown

Proportional split between external traffic, DNS, system security events, and localhost noise

Apps & Package Activity

Active packages alongside recent installations, updates, and removals

Bluetooth Devices & Connections

Seen MAC addresses with successful, failed, and disconnect counts

Phone Unlocks & System Security

Daily screen unlock cadence, night activity, and Keystore / process counts

External Network & Queried Domains

All outbound WAN endpoints, DNS volume, and queried domains

Daily Activity

Click any day bar to open its raw log entries

Hourly Activity Matrix

Days × 24 hours — helps separate active device usage from background telemetry

Notable Findings

Automatically flagged patterns across network, apps, Bluetooth, and lockscreen events

Review Queue & Audit Notes

Mark known apps, domains, or IPs as Safe or Ignored to keep focus on suspicious activity

Traffic scope

DNS & IP Correlation Lookup

Search any IP address, hostname, port, or package name to trace connections

Apps by Traffic

All matching apps — click an app to open its full inspector drawer

Traffic by Category

All Queried Domains

Full list of resolved and queried domains with IP mappings

1 / 1

All Destination Ports

Full list of destination ports and using applications

1 / 1

All Outbound WAN IPs

Every contacted public IP address with calling applications and resolved DNS domains

1 / 1

Unencrypted HTTP (Port 80)

Direct-to-IP Connections (No DNS)

Local Debug & Instrumentation Probes

Connections to 127.0.0.1 on Frida (27042/27043), ADB (5037/5555), or proxy ports

Interactive Connection Map & Graph

Visualize which apps talk to which domains, IPs, ports, and shared infrastructure

App / Package Domain (DNS) IP : Port Direct-IP / HTTP 80 / Debug Probe

All Matched Connection Edges

Every recorded App -> Domain -> IP:Port edge matching current filters

1 / 1

Packages (0)

Click a package name to inspect hashes, domains, and connections

Security Event Types

Click any event type to inspect its daily timeline and jump to records

All Security Event Types

Daily breakdown for the selected security event subtype

Phone Unlock & Lockscreen Audit

Daily unlock counts, 24-hour unlock pattern, authentication attempts, and screen locks

Package Installations, Updates & Uninstalls

All recorded app installs, version updates, and removals over time

Bluetooth Connections & Disconnections

Paired devices, connection attempts, failures, and disconnect timestamps

Process Launches (app_process_start)

All launched processes by count and chronological execution timeline

Keystore Operations by UID

Generated, destroyed, and imported cryptographic keys attributed to apps

User Restrictions & Logging Events

Policy restrictions added/removed and intrusion logging daemon start events

Search Security Events

Query all security events with full filtering, status, ordering, and pagination

Page 1

Event Path & Session Flow

Chronological timeline grouping related unlocks, connections, installs, processes, and keys into time-window sessions

Select a day and mode to build the grouped event timeline.

Raw Log Search

Search raw JSON lines for a specific date

Select a date and click Search day.