A lookup is a device asking for a name. It is not a minute and not a byte, and it is not proof anyone looked at anything: apps ask for names in the background all day. Blocked means the name was not answered (or was answered with the portal's address). Nothing here can see inside HTTPS, and a device on a VPN or DNS-over-HTTPS is invisible to all of it.

Worth a look

Counts of lookups, not of people or of visits. One page can ask for an adult domain many times through an embedded advert; one child can ask once. Open the log before drawing a conclusion, and treat what you find as the start of a conversation.

"Adult" and "gambling" are the names of the blocklists that matched (OISD NSFW and HaGeZi Gambling, as AdGuard is set up). A blocklist can be wrong about a site. Rows from before 2026-09-02 have no recorded reason, so they can only ever show as "blocked".

Lookups over time

DNS lookups per day, stacked by the person whose device asked.

• Nova
• Rangi
• Piper
• Ari
• Marama
• Unattributed, and Callum, Dorothy

Unattributed lookups come from devices not yet assigned to anyone. Name them on the Devices tab and they start counting for that person.

Blocked, and why

Blocked lookups per day, by the reason AdGuard gave. Adverts and trackers are usually most of it and mean nothing about the person; the rest is what the filter is for.

• Adult site, blocked by the adult blocklist 8
• Gambling site, blocked by the gambling blocklist 10
• VPN, proxy or DNS-over-HTTPS bypass, blocked 18
• Cut off (time up, bedtime or a block), sent to the portal 140
• A service switched off for this child (TikTok, Instagram...) 15
• A category switched off for this child, by Genkan's rules 38
• Advert or tracker, blocked 217

"Sent to the portal" is a child whose internet was off (time up, bedtime, or a block): every name their device asked for was answered with the portal's address, so a hundred of those is one open browser, not a hundred attempts.

Top sites, by lookups

The names each person's devices asked for most. Coloured where the site is in a metered category (gaming, video, social); grey is everything else, including the CDNs and app back-ends that make up most of any device's lookups. Click a name to see every lookup of it.

Minutes per category

Metered minutes per day for each child, from the firewall counters (METERING.md). A minute counts when the device moved real traffic to that category in that minute, so a backgrounded app does not rack up time. Music, schoolwork and messaging are never metered.

• Gaming
• Video
• Social

Nova

gaming 2h 5m · video 4h 8m · social 0 min

Rangi

gaming 6h 19m · video 6h 14m · social 1h 1m

Piper

gaming 4h 57m · video 5h 40m · social 4h 50m

These are the same figures as the Trends tab. They are measured, not derived from the lookup counts above, and the two must not be added together. A child with no metered minutes in the window (a visiting child is never metered) is not listed.

The log

Every lookup in the window, newest first. Pick a person, then a site, and read every time a device asked for it. Genkan keeps domains only, never what was on a page, and keeps them for thirty days.

Showing: person: Unattributed · site: nordvpn.com, last 7 days.

That is the end of the log for these filters.

A row is one question from one device: "what is the address of this name?" It is not a page view, not a minute, and not proof a person did anything. Blocked means the name got no real answer. Times follow the gateway's clock. What this cannot see: anything inside HTTPS, anything a device sends through a VPN, Cloudflare WARP or its own DNS-over-HTTPS, and anything on mobile data.

How to read this page

Genkan is a family conversation aid, not a surveillance console. Domains only, thirty days, all of it in the house.