Bulk IP Lookup
Up to fifty addresses at once. Paste a clean list or a raw log; the addresses are found either way.
Paste whatever you have
Anything shaped like an IP address is picked out of the text, so a list does not need tidying first. A server log, a firewall report, a spreadsheet column, a comma-separated string: all of them work. Duplicates are removed before the batch is counted, so a log with the same address a hundred times uses one of your fifty rather than a hundred.
Fifty is a deliberate ceiling. Each public address is a separate request to the location service, and a larger batch would either run past a sensible timeout or hit a rate limit and start failing halfway through, which is worse than refusing.
Private addresses cost nothing
A private, loopback or reserved address is recognised here and labelled without any external request, because it has no public location for a service to return. In a log paste this matters: internal traffic often makes up most of the lines, and none of it consumes the allowance.
No reverse DNS in bulk
A single reverse lookup can take several seconds when a nameserver is slow to answer, and fifty of those in one request would exceed any reasonable timeout. For a hostname, use the single IP Lookup, which includes it, or the Reverse IP Lookup, which also checks whether the name holds up.
What the columns mean
| Column | Meaning |
|---|---|
| Country and city | Where the network is registered or routed. Country is near-certain; city is right about three quarters of the time. |
| ISP | The provider name, which is often a brand or a reseller. |
| ASN | The autonomous system that announces the address block. More reliable than the ISP name for identifying who operates an address. |
For a batch of log addresses the ASN column is usually the most useful. It groups traffic by the network behind it, which is how a burst of requests from a dozen different addresses turns out to be one cloud provider.
How to use it
Paste your addresses and press Look up. The count above the button updates as you type so you can see how many will be checked before you start. Download CSV saves the results as a spreadsheet file built in the page.
Questions
How many addresses can I check at once?
Fifty in one pass. That is a deliberate ceiling rather than a technical one: each address is a separate request to the location service, and a larger batch would either time out or hit the rate limit. Duplicates are removed before counting, so a list with repeats goes further than it looks.
Can I paste a server log rather than a clean list?
Yes. Anything that looks like an IP address is picked out of whatever you paste, so a log excerpt, a firewall report or a column copied from a spreadsheet all work without being tidied first.
Why is there no reverse DNS in the results?
Because a single reverse lookup can take several seconds when a nameserver is slow, and fifty of them in one request would run past any reasonable timeout. Use the single IP Lookup or the Reverse IP Lookup for an address you want the hostname for.
Do private addresses use up my batch?
They count towards the fifty but cost nothing: a private or reserved address is recognised here and labelled without any external request, because it has no public location for a service to return.
Is my list of addresses stored?
No. The addresses are resolved and returned, and nothing is written down. Individual results are cached on the server for a day so a repeated address costs nothing, but the list you submitted is not kept.
Related tools
Browse all Sigma Wire tools - every free tool on the site, grouped by category.