A lookup is a device asking for a name. It is not a minute and not a byte, and it is not proof anyone looked at anything: apps ask for names in the background all day. Blocked means the name was not answered (or was answered with the portal's address). Nothing here can see inside HTTPS, and a device on a VPN or DNS-over-HTTPS is invisible to all of it.
Counts of lookups, not of people or of visits. One page can ask for an adult domain many times through an embedded advert; one child can ask once. Open the log before drawing a conclusion, and treat what you find as the start of a conversation.
"Adult" and "gambling" are the names of the blocklists that matched (OISD NSFW and HaGeZi Gambling, as AdGuard is set up). A blocklist can be wrong about a site. Rows from before 2026-09-02 have no recorded reason, so they can only ever show as "blocked".
DNS lookups per hour today, stacked by the person whose device asked. Hours follow the gateway's clock; the current hour is part-finished.
Unattributed lookups come from devices not yet assigned to anyone. Name them on the Devices tab and they start counting for that person.
| When | Nova | Rangi | Piper | Ari | Marama | Unattributed, and Callum, Dorothy | Blocked | Total |
|---|---|---|---|---|---|---|---|---|
| 00:00 | 0 | 15 | 0 | 0 | 0 | 0 | 15 | 15 |
| 01:00 | 0 | 53 | 0 | 0 | 1 | 0 | 53 | 54 |
| 02:00 | 0 | 49 | 0 | 0 | 0 | 0 | 49 | 49 |
| 03:00 | 0 | 23 | 0 | 0 | 0 | 1 | 23 | 24 |
| 04:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 05:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 06:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 07:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 08:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 09:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 10:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 11:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 12:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 13:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 14:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 15:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 16:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 17:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 18:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 19:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 20:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 21:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 22:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 23:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Blocked lookups per hour, by the reason AdGuard gave. Adverts and trackers are usually most of it and mean nothing about the person; the rest is what the filter is for.
| When | Portal | Total |
|---|---|---|
| 00:00 | 15 | 15 |
| 01:00 | 53 | 53 |
| 02:00 | 49 | 49 |
| 03:00 | 23 | 23 |
| 04:00 | 0 | 0 |
| 05:00 | 0 | 0 |
| 06:00 | 0 | 0 |
| 07:00 | 0 | 0 |
| 08:00 | 0 | 0 |
| 09:00 | 0 | 0 |
| 10:00 | 0 | 0 |
| 11:00 | 0 | 0 |
| 12:00 | 0 | 0 |
| 13:00 | 0 | 0 |
| 14:00 | 0 | 0 |
| 15:00 | 0 | 0 |
| 16:00 | 0 | 0 |
| 17:00 | 0 | 0 |
| 18:00 | 0 | 0 |
| 19:00 | 0 | 0 |
| 20:00 | 0 | 0 |
| 21:00 | 0 | 0 |
| 22:00 | 0 | 0 |
| 23:00 | 0 | 0 |
"Sent to the portal" is a child whose internet was off (time up, bedtime, or a block): every name their device asked for was answered with the portal's address, so a hundred of those is one open browser, not a hundred attempts.
The names each person's devices asked for most. Coloured where the site is in a metered category (gaming, video, social); grey is everything else, including the CDNs and app back-ends that make up most of any device's lookups. Click a name to see every lookup of it.
Open the log for a site: youtube.com rbxcdn.com roblox.com googlevideo.com docs.google.com ytimg.com snapchat.com spotify.com twitch.tv cdninstagram.com
| Site | Category | Lookups | Blocked |
|---|---|---|---|
| youtube.com | video | 18 | 18 |
| rbxcdn.com | gaming | 14 | 14 |
| roblox.com | gaming | 13 | 13 |
| googlevideo.com | video | 11 | 11 |
| docs.google.com | schoolwork | 7 | 7 |
| ytimg.com | video | 7 | 7 |
| snapchat.com | social | 6 | 6 |
| spotify.com | audio | 6 | 6 |
| twitch.tv | video | 5 | 5 |
| cdninstagram.com | social | 4 | 4 |
Open the log for a site: rbxcdn.com
| Site | Category | Lookups | Blocked |
|---|---|---|---|
| rbxcdn.com | gaming | 1 | 0 |
Open the log for a site: discord.com
| Site | Category | Lookups | Blocked |
|---|---|---|---|
| discord.com | social | 1 | 0 |
Metered minutes per day for each child, from the firewall counters (METERING.md). A minute counts when the device moved real traffic to that category in that minute, so a backgrounded app does not rack up time. Music, schoolwork and messaging are never metered. The meter works by day, so today is one column.
Nova
gaming 16 min · video 28 min · social 0 min
| Day | Gaming | Video | Social |
|---|---|---|---|
| Wed 11 Nov | 16 | 28 | 0 |
Rangi
gaming 54 min · video 49 min · social 7 min
| Day | Gaming | Video | Social |
|---|---|---|---|
| Wed 11 Nov | 54 | 49 | 7 |
Piper
gaming 32 min · video 34 min · social 28 min
| Day | Gaming | Video | Social |
|---|---|---|---|
| Wed 11 Nov | 32 | 34 | 28 |
These are the same figures as the Trends tab. They are measured, not derived from the lookup counts above, and the two must not be added together. A child with no metered minutes in the window (a visiting child is never metered) is not listed.
Every lookup in the window, newest first. Pick a person, then a site, and read every time a device asked for it. Genkan keeps domains only, never what was on a page, and keeps them for thirty days.
Showing: person: Piper · site: cdninstagram.com, today.
| When | Person | Device | Name asked for | Category | What happened |
|---|
A row is one question from one device: "what is the address of this name?" It is not a page view, not a minute, and not proof a person did anything. Blocked means the name got no real answer. Times follow the gateway's clock. What this cannot see: anything inside HTTPS, anything a device sends through a VPN, Cloudflare WARP or its own DNS-over-HTTPS, and anything on mobile data.
Genkan is a family conversation aid, not a surveillance console. Domains only, thirty days, all of it in the house.