A lookup is a device asking for a name. It is not a minute and not a byte, and it is not proof anyone looked at anything: apps ask for names in the background all day. Blocked means the name was not answered (or was answered with the portal's address). Nothing here can see inside HTTPS, and a device on a VPN or DNS-over-HTTPS is invisible to all of it.

Worth a look

Counts of lookups, not of people or of visits. One page can ask for an adult domain many times through an embedded advert; one child can ask once. Open the log before drawing a conclusion, and treat what you find as the start of a conversation.

"Adult" and "gambling" are the names of the blocklists that matched (OISD NSFW and HaGeZi Gambling, as AdGuard is set up). A blocklist can be wrong about a site. Rows from before 2026-09-02 have no recorded reason, so they can only ever show as "blocked".

Lookups over time

DNS lookups per day, stacked by the person whose device asked.

• Nova
• Rangi
• Piper
• Ari
• Marama
• Unattributed, and Callum, Dorothy

Unattributed lookups come from devices not yet assigned to anyone. Name them on the Devices tab and they start counting for that person.

Blocked, and why

Blocked lookups per day, by the reason AdGuard gave. Adverts and trackers are usually most of it and mean nothing about the person; the rest is what the filter is for.

• Adult site, blocked by the adult blocklist 39
• Gambling site, blocked by the gambling blocklist 38
• VPN, proxy or DNS-over-HTTPS bypass, blocked 45
• Cut off (time up, bedtime or a block), sent to the portal 140
• A service switched off for this child (TikTok, Instagram...) 47
• A category switched off for this child, by Genkan's rules 132
• Advert or tracker, blocked 992

"Sent to the portal" is a child whose internet was off (time up, bedtime, or a block): every name their device asked for was answered with the portal's address, so a hundred of those is one open browser, not a hundred attempts.

Top sites, by lookups

The names each person's devices asked for most. Coloured where the site is in a metered category (gaming, video, social); grey is everything else, including the CDNs and app back-ends that make up most of any device's lookups. Click a name to see every lookup of it.

Minutes per category

Metered minutes per day for each child, from the firewall counters (METERING.md). A minute counts when the device moved real traffic to that category in that minute, so a backgrounded app does not rack up time. Music, schoolwork and messaging are never metered.

• Gaming
• Video
• Social

Nova

gaming 9h 22m · video 16h 47m · social 0 min

Rangi

gaming 27h 44m · video 29h 45m · social 3h 51m

Piper

gaming 28h 53m · video 24h 36m · social 19h 51m

These are the same figures as the Trends tab. They are measured, not derived from the lookup counts above, and the two must not be added together. A child with no metered minutes in the window (a visiting child is never metered) is not listed.

The log

Every lookup in the window, newest first. Pick a person, then a site, and read every time a device asked for it. Genkan keeps domains only, never what was on a page, and keeps them for thirty days.

Showing: person: Piper · site: wikipedia.org, last 30 days.

That is the end of the log for these filters.

A row is one question from one device: "what is the address of this name?" It is not a page view, not a minute, and not proof a person did anything. Blocked means the name got no real answer. Times follow the gateway's clock. What this cannot see: anything inside HTTPS, anything a device sends through a VPN, Cloudflare WARP or its own DNS-over-HTTPS, and anything on mobile data.

How to read this page

Genkan is a family conversation aid, not a surveillance console. Domains only, thirty days, all of it in the house.