Extract unique IPs from Nginx, Apache & IIS logs

Quick answer

The first step in almost any IP investigation is getting a clean, de-duplicated list of addresses out of your server logs. A few terminal commands do it in seconds. Here are the patterns for the common log formats.

Nginx and Apache (Linux/macOS)

Both write the client IP as the first field of each line by default, so awk plus sort extracts and de-duplicates them:

awk '{print $1}' access.log | sort -u

To rank IPs by how many requests each made — so the noisiest sources surface first — add a count:

awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20

That gives the top 20 IPs by request volume — usually where you start an abuse investigation.

If your log format differs

If the client IP isn’t field 1 (custom formats, or behind a proxy where the real IP is in X-Forwarded-For), change the field number ($1 → $N) to match, or grep the IP pattern directly:

grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' access.log | sort -u

That pulls every IPv4 address regardless of position. (For IPv6 you’d extend the pattern to match colon-hex groups.)

IIS logs (Windows)

IIS logs are space-delimited with the client IP in the c-ip field. In PowerShell, parse it by splitting each line and selecting that column, then de-duplicate with Sort-Object -Unique. The exact field index depends on your log’s configured fields (check the #Fields: header line), but the approach is the same: isolate the c-ip column, sort, unique.

Next: audit the list

Once you have the unique IPs (and ideally their request counts), feed the top offenders into our Bulk IP Audit tool for reverse DNS, blocklist, and ASN/geolocation — turning a raw list into an actionable picture. See auditing multiple IPs from server logs for the full workflow.