Input
Upload a CSV or paste lines like ip,count.
You can also paste just IP addresses (duplicates allowed) and we’ll count duplicates automatically.
Headered CSVs (ex: SenderIPv4 + EmailCount) are auto-detected.
Tip: if your CSV has columns like SenderIPv4,SenderFromDomain,EmailCount we’ll detect the IP and count automatically.
Microsoft 365 Defender → Advanced hunting
Use this query to export sender IP volume to CSV (adjust the time range as needed).
Open: security.microsoft.com
EmailEvents | where Timestamp > ago(7d) | where isnotempty(SenderIPv4) | summarize EmailCount = count() by SenderIPv4, SenderFromDomain | order by EmailCount desc
GeoIP lookup isn’t available on this server.
Heatmap
Mouse around to explore. The heat intensity scales with count.
Results
Breakdowns and detailed points from the current view (including filters).
Filter:
Tip: Ctrl/Cmd-click selects multiple. Shift-click keeps the other filter (Country ∩ ASN).
Country breakdown
Top countries by total count. Click a row to filter the map. Ctrl/Cmd-click selects multiple. Shift-click keeps the other filter.
| Country | ISO | Total count | Unique IPs |
|---|---|---|---|
| No data yet. | |||
ASN / Provider breakdown
Top autonomous systems (hosting/provider networks) by total count. Click a row to filter the map. Ctrl/Cmd-click selects multiple. Shift-click keeps the other filter.
| ASN / Org | Total count | Unique IPs |
|---|---|---|
| No data yet. | ||
Points (current view)
No points yet.
| Lat | Lon | Weight | Country | ASN / Org |
|---|---|---|---|---|
| No data yet. | ||||
Tip: this table is a preview (first 200 rows). Use export for full data.
Output stays in your browser. The server only receives unique IPs + counts for geolocation.