AI use from DNS and web-filter logsFree edition

Shadow AI report

Example organisation

Period covered
21–27 Sep 2026 (7 days)
Generated
6 Oct 2026
Source
1 log file, 3,003 lines
AI tool list
Free list, 300 tools
AI tools detected
25
of the 300 tools on the free list
Users on AI tools
26
of 40 users or devices in the log
AI-tool requests
556
11 blocked by your filter
Share of requests
18.5%
of 3,000 requests analysed
High-risk tools
2
tools rated high for risk or data sovereignty
Tools in use

AI tools reached from your network

25 tools from the free list, sorted by number of requests. Requests include attempts that your filter blocked.

ToolCategoryRiskData sovereigntyRequestsUsersBlocked
ChatGPT
chatgpt.com
Text & Language
General assistants & chatbots
MediumLow110110
Perplexity
perplexity.ai
Search, Knowledge & Docs
AI search & answer engines
MediumLow4990
OpenAI
openai.com
Models & Infrastructure
Foundation models & model APIs
MediumLow39130
Dify
dify.ai
Agents & Automation
Agent-building frameworks
LowLow38100
Dust
dust.tt
Agents & Automation
General autonomous agents
LowLow2860
Paperguide
paperguide.ai
Search, Knowledge & Docs
AI search & answer engines
LowLow2610
Gamma
gamma.app
Productivity & Collab
Presentation & slide generation
MediumLow2560
Groq
groq.com
Models & Infrastructure
Hosting & inference platforms
LowLow2560
Paperguide
chatwithpdf.ai
Data, Analytics & Research
Academic research assistants
LowLow2230
ElevenLabs
elevenlabs.io
Audio, Voice & Music
Meeting assistants
MediumLow1910
Limitless
limitless.ai
Productivity & Collab
Meeting assistants
MediumLow1950
MyMemo
mymemo.ai
Search, Knowledge & Docs
Note-taking & second brain
LowLow1870
Character.AI
character.ai
Lifestyle & Entertainment
AI companions & character chat
MediumLow1630
Wudpecker
wudpecker.io
Productivity & Collab
Meeting assistants
LowLow1660
Midjourney
midjourney.com
Image & Visual
Illustration & character
MediumLow1550
Dot
getdot.ai
Data, Analytics & Research
BI & natural-language analytics
LowLow1420
Baz
baz.co
Code & Development
Code review
LowLow1320
JobCopilot
jobcopilot.com
Business & Vertical
HR & recruiting
MediumLow1120
Zipy AI
zipy.ai
Code & Development
Debugging & error monitoring
LowLow1170
Chad
chadgpt.ru
Text & Language
General assistants & chatbots
HighHigh927
Professionally
professionally.ai
Text & Language
Email writing
LowLow940
VihokAI
vihokai.com
Text & Language
General assistants & chatbots
MediumMedium830
AptEdge
aptedge.io
Customer Support
Ticket routing & agent-assist
LowUnknown610
ContractCrab
contractcrab.com
Business & Vertical
Legal
LowLow510
DreamActor-M1
dreamactor.org
Video
Animation & motion graphics
HighHigh544
By category

AI use by category

Requests per category of AI tool, with the number of distinct tools in each.

Risk

Tools that need a closer look

12 of the AI tools found carry a high or medium rating for risk or data sovereignty. Review these first.

Risk level

An overall rating from the AI Tools Blocklist register of how much caution a tool needs before people use it with work data.

High
Treat as not approved for work data. Blocking is the usual response.
Medium
Use only with controls: an approved account, and no confidential or personal data.
Low
No specific concern recorded. Your normal rules still apply.

Data sovereignty

How far the tool’s ownership, hosting or legal jurisdiction places what people type or upload under foreign data-access laws.

High
Data is likely to fall under a jurisdiction that many organisations and regulators do not accept.
Medium
Some exposure. Check where the data is processed before approving the tool.
Unknown
Not enough public information to tell. Treat as unapproved until checked.
ToolRiskData sovereigntyWhy it is listedRequestsUsers
Chad
chadgpt.ru
HighHighHigh risk rating; high data-sovereignty exposure92
DreamActor-M1
dreamactor.org
HighHighHigh risk rating; high data-sovereignty exposure54
ChatGPT
chatgpt.com
MediumLowMedium risk rating11011
Perplexity
perplexity.ai
MediumLowMedium risk rating499
OpenAI
openai.com
MediumLowMedium risk rating3913
Gamma
gamma.app
MediumLowMedium risk rating256
ElevenLabs
elevenlabs.io
MediumLowMedium risk rating191
Limitless
limitless.ai
MediumLowMedium risk rating195
Character.AI
character.ai
MediumLowMedium risk rating163
Midjourney
midjourney.com
MediumLowMedium risk rating155
JobCopilot
jobcopilot.com
MediumLowMedium risk rating112
VihokAI
vihokai.com
MediumMediumMedium risk rating; medium data-sovereignty exposure83
People and devices

Top users by AI-tool requests

Showing the top 25 of 26 users and devices that reached an AI tool on the list. Identities are shown as recorded in the log: e-mail, user name, device or IP address. Run with --anonymise to replace them with pseudonyms. Use this to understand demand, not to single people out.

#UserAI requestsToolsMost usedFlagged tools
1[email protected]6310Paperguide, ChatGPT, Dify4
2[email protected]428ChatGPT, Baz, Perplexity5
3[email protected]385Perplexity, ChatGPT, Dust3
4[email protected]377ChatGPT, Groq, Dust3
5[email protected]378Dot, Paperguide, Perplexity4
6[email protected]365ElevenLabs, Paperguide, Limitless4
7[email protected]317Character.AI, Groq, ChatGPT3
8[email protected]245JobCopilot, AptEdge, ChatGPT3
9[email protected]223ChatGPT, Wudpecker, OpenAI2
10[email protected]215Chad, Perplexity, Dify3
11[email protected]183ChatGPT, JobCopilot, DreamActor-M13
12[email protected]185ChatGPT, OpenAI, Dify2
13[email protected]172ChatGPT, Midjourney2
14[email protected]164Perplexity, Dify, Zipy AI1
15[email protected]164ChatGPT, Baz, Wudpecker1
16[email protected]165Perplexity, OpenAI, Dify3
17[email protected]166MyMemo, Midjourney, Gamma3
18[email protected]135Limitless, Zipy AI, Chad4
19[email protected]133ContractCrab, Gamma, Groq1
20[email protected]134Dot, Professionally, Wudpecker1
21[email protected]135OpenAI, Perplexity, Dify3
22[email protected]123Character.AI, OpenAI, MyMemo2
23[email protected]82Gamma, Wudpecker1
24[email protected]73MyMemo, VihokAI, OpenAI2
25[email protected]72Dify, MyMemo0
Next steps

What to do with this report

  1. Write down an AI acceptable-use policy.Say which AI tools are approved, which data must never be typed or uploaded into an AI tool (customer and personal data, credentials, source code, confidential documents) and how people ask for a new tool.
  2. Decide per category: allow, allow with controls, or block.Use the category list above as a starting point. Controls can mean company accounts with single sign-on, training switched off, or a rule against confidential data.
  3. Review the flagged tools first.For each tool rated high for risk or data sovereignty, check whether anyone needs it for work. If not, block it in your DNS or web filter; if so, find an approved alternative.
  4. Talk to the teams behind the heaviest use.Heavy use usually signals a real need. An approved tool meets it better than a block alone.
  5. Run this report again every month.Compare the numbers to check that the policy works and to catch new tools early.
Coverage and method

What this report can and cannot see

This free edition recognises only the 300 AI tools of the free list. Requests to AI tools that are not on the list are counted here as ordinary traffic, so a low or zero count does not mean low or zero AI use.

AI-tool list: AI tools free list (300 tools). Sources: AI Tools Taxonomy dataset sample and AI Tools Blocklist free sample and most visited tools, Alpha Quantum, licensed CC BY 4.0.

Log lines read
3,003
Requests analysed
3,000
Lines skipped
3
Distinct domains seen
61
FileFormatColumns usedLinesUsedSkipped
example-dns-log.csvcsvdomain: query_name, user: user / src_ip, time: timestamp, action: action3,0033,0003

What counts as a match. A request counts for a tool when the domain in the log is the tool’s domain or a subdomain of it (api.example.ai counts for example.ai). Domains are lower-cased, and a leading www. and trailing dots are removed first.

What a request is. One line of the log. DNS logs record look-ups, not page views or prompts: one visit can cause several look-ups, and devices cache answers. Treat the counts as a measure of activity, not as an exact number of uses.

Users. Counted from the user, e-mail, device or IP column of the log. One person on several devices counts more than once; several people behind one IP address count once.

Skipped lines could not be read or had no valid domain. Times are shown in UTC when the log states a time zone, otherwise as written in the log.

Full edition

What the full register adds

The full register covers more than 11,000 AI tools, updated daily. Compared with this free edition it adds:

  • Thousands more tools than the 300 on the free list.
  • Daily updates, so new AI tools are recognised as they appear.
  • Training-policy flags: whether a tool trains on what people type by default, and whether that can be switched off.
  • Ready-made policy verdicts: allow, allow with controls, or block.
https://www.shadowaitools.com/free-shadow-ai-report/