Bulk IP Lookup
Look up many IP addresses at once — country, city, ISP and proxy/VPN flags, exportable as CSV
One IP per line, or comma/space separated. IPv4 and IPv6; a trailing :port is ignored. Up to 25 addresses per lookup, 3 lookups per day.
What a bulk IP lookup returns
| Field | Meaning |
|---|---|
| IP address | The address as looked up, IPv4 or IPv6 |
| Country | Issuing country of the IP block, with ISO alpha-2 code |
| Region | State, province or administrative area |
| City | Nearest city the block maps to (approximate) |
| ISP / network | The operator that announces the block |
| ASN | Autonomous System Number that routes the address |
| Time zone | IANA zone for the mapped location |
| Proxy / VPN | Whether the address is a known proxy, VPN or hosting exit |
Each IP resolves to the network and location attributes below. Empty cells mean the provider has no data for that address, not that the address is invalid.
| Use case | Why it matters |
|---|---|
| Fraud & risk review | Score a batch of order or login IPs at once and surface the ones on hosting, proxy or VPN ranges |
| Log & incident triage | Turn a list of addresses from a server log into countries, ISPs and ASNs you can act on |
| Compliance & geo-restriction | Confirm which countries a set of sessions originated from for licensing or sanctions checks |
| Traffic & analytics QA | Validate that a sample of visitor IPs maps to the regions your reporting claims |
| Abuse reporting | Group offending addresses by ASN so you can file one report per network operator |
Getting the most from bulk IP lookups
Paste straight from your logs
Entries can be separated by newlines, commas, spaces or semicolons, and a trailing port is stripped automatically — 203.0.113.9:443 and [2001:db8::1]:8080 both resolve to the address. Duplicates are collapsed before lookup so they don't eat your quota.
Treat city-level data as a hint
Country and ASN are the reliable fields. City and region are inferred from registry and routing data and are commonly off by a wide margin on mobile carriers, satellite links and corporate networks. Build rules on country or network, not on city.
Group by ASN before you act
Ten addresses on one hosting ASN is a very different signal from ten addresses on ten residential ISPs. Export the CSV and pivot on the ASN column before deciding to block anything.
Use proxy/VPN flags as one signal among several
A VPN exit is not evidence of fraud — plenty of legitimate users are behind one. Combine the flag with the card's issuing country, order value and account history rather than declining on it alone.
Private ranges won't resolve
10.x, 192.168.x, 172.16–31.x, 127.x, CGNAT (100.64–127.x) and link-local addresses have no public geolocation and are reported as invalid. If your logs contain them, your proxy is recording the internal hop instead of the client address.
Pair it with the BIN + IP check
For payments, the useful question is whether the IP country matches the card's issuing country. Run the batch here to triage, then send the interesting rows through the BIN + IP tool for a per-transaction match verdict.
Bulk IP lookup FAQ
It is a tool that geolocates many IP addresses in a single pass instead of one at a time. You paste a list of IPv4 or IPv6 addresses and get back a table with each address's country, region, city, ISP, ASN, time zone and proxy/VPN status, plus which entries were invalid or could not be resolved.
Related tools
IP geolocation is an estimate derived from routing and registry data, not a physical address. City-level results are approximate and mobile, satellite and corporate-VPN ranges are frequently wrong. Proxy/VPN flags are signals, not proof. Use these results as one input to a risk decision — never as the sole basis for blocking, pricing or identifying a person. Submitted lists are not retained.