Technologies are generally described for systems, methods and devices effective to analyze a file. In some examples, a processor may receive the file. The file may include content and instructions. The content may include data executable by a browser. The processor may analyze the instructions. The processor may identify an internet protocol (IP) address in the instructions based on the analysis. The processor may compare the identified IP address with a list of IP addresses associated with an attack. The processor may generate an alert based on the comparison.