Workbench
Paste or load records and the page grades, links and times them with the same rules as the CLI. It runs in this page via WebAssembly: nothing you paste is uploaded. Record text is shown as inert text, URLs defanged.
Records
Paste records below, drop files or a folder here, or start from an example.
NDJSON, a JSON array, Wayback CDX JSON, one URL per line (optionally after a timestamp), or a web server access log (name your host in the field map: host=www.example.org). Several files, a folder, or .zip, .tar, .tar.gz, .tgz and .gz archives are unpacked here and analysed as one.
Example loaded: the synthetic showcase the home page walks through. None of it was collected; target hosts are placeholders and networks documentation ASNs.
Access-log preset: paste your web server's log (Common or Combined Log Format) and put your own host in the field map, e.g. host=www.example.org. The log stays in this page.
Clusters
Analyse records to see their clusters: records linked by shared inbox IDs, unique tags, or the same target in a short window.
Explore
Runs over time, the fleet and swarm graphs, rules against clusters and the hourly rhythm appear here once records are analysed.
Flagged records
The filter matches the defanged URL, the rule ids and, for a set of files, the file name, ignoring case. The CSV holds the records the table lists, in its order.
No records yet.
Endpoints
Flagged requests per target host; times are UTC. Hits counts the suggestive or significant records to the host, out of every record that targets it (hits / all). "Ongoing" means hit within 7 days of the newest record loaded: what an affected operator checks their logs for.
No endpoints yet.
Report
A disclosure draft from this analysis, scoped to the selected cluster if there is one. It follows the CLI's naming gate: outside case notes, a developer is named only on evidence at or above the level you pick. Model names in requests never name one on their own; an ASN names the host.
Claims from case work
The JSON array swarmchase report --claims reads, e.g. [{"party":"Example AI","role":"developer","evidence":"provider_confirmed","details":["confirmed in writing"]}]. Kept in this page only.
Analyse records to draft a report.
Share sightings
A swarm that hits many sites is invisible to any one of them. A sightings file lets you share what it left in your log without sharing the log: keyed hashes of its run tags, inbox ids and captured secrets, how its requests were made, the hours it was active and its grade. No URL, path, query value, IP address, user agent or cookie goes in, and your host names only if you tick the box. The page shows the whole file before you save it and sends nothing; you choose whether to send it, and to whom. See sharing sightings.
Analyse records, then press Prepare to see exactly what a sightings file would hold.