Bulk IP Geolocation

Last updated April 21, 2026

What Is Bulk IP Geolocation Lookup?

Bulk IP geolocation lookup is the process of enriching a list of IP addresses with country, city, ISP, ASN, threat, and network metadata in a single batch operation. Instead of querying one address at a time, a bulk tool accepts up to 100 IPs per submission and returns all 40+ data fields per IP in one pass — usually within a few seconds. This is the standard way to process server log files, customer signup lists, fraud-review queues, and network-audit exports.

How Bulk Lookup Works

Paste or upload up to 100 IPv4 or IPv6 addresses. Each IP is resolved in parallel against MaxMind GeoLite2 and DB-IP Lite — two independent geolocation databases — and then cross-referenced with our threat, VPN, Tor, and ASN tables. When one database has a gap, the other fills it in, producing a composite result that is more complete than any single source. Results stream back as they finish; the full report is ready within 2–5 seconds for a typical 100-IP batch.

Who Uses Bulk IP Lookup?

Four audiences pull the heaviest use from a batch tool:

• Fraud and risk analysts investigating clusters of suspicious signups or transactions. A single list of 50 IPs can reveal country mismatches, VPN/proxy concentrations, or datacenter origins that point to coordinated abuse.
• Security engineers triaging incident logs — firewall blocks, SSH brute-force attempts, or web-app attack traces. Running the IP set through a bulk tool flags which sources are residential (likely compromised endpoints) vs datacenter (likely scripted attackers) within seconds.
• Data and analytics teams enriching historical logs with country/city/ISP attributes before loading into BI warehouses. A one-time bulk run against a sample of recent traffic is usually enough to validate an enrichment pipeline before committing to an API integration.
• Sales and marketing operations cleaning an MQL list or enriching form-submission exports with country and ASN (for company mapping). Residential vs corporate IP signals are a cheap but useful buying-intent filter when combined with other data.

Data Fields Included

Each IP in a bulk report comes back with 40+ fields across four categories:

• Location — country, country code, state, city, postal code, latitude, longitude, timezone, continent, accuracy radius.
• Network — ISP, organization, ASN, AS name, connection type, PTR / reverse DNS, hostname, is-hosting-provider flag.
• Security — is-VPN, is-Tor-exit, is-proxy, is-datacenter, is-bogon, threat score, blacklist membership, known-scanner flag.
• Context — currency, calling code, sanctions status, language, country flag — useful for localization, compliance, and analytics enrichment.

Exports are available in CSV, JSON, Excel (XLSX), PDF, and XML. The free preview returns the first 5 IPs unblurred so you can verify quality before unlocking the full report.

Frequently Asked Questions

How many IPs can I check at once?

Each bulk lookup accepts up to 100 IPv4 or IPv6 addresses per submission. For larger lists, split them into 100-IP batches — pricing scales per batch, and paid reports stay accessible for 30 days. If you need a higher per-request limit or programmatic access, the public API supports higher batch sizes on paid tiers.

What export formats are supported?

Paid reports export as CSV, JSON, Excel (XLSX), PDF, and XML. All formats include the full 40+ fields per IP. CSV and JSON are optimized for programmatic consumption; PDF and XLSX are formatted for team sharing and archival.

How accurate is bulk geolocation?

Country-level accuracy is 95–99% across our two data sources (MaxMind GeoLite2 and DB-IP Lite). City-level accuracy drops to 50–80% depending on region, ISP, and whether the IP belongs to a residential, mobile, or datacenter network. We surface an accuracy-radius field per result so you can gate downstream logic on confidence rather than treat every result as equal.

Are my IPs private? Do you store them?

IP submissions are stored only under your account and only for the 30-day access window of your paid report. We don't share them with third parties, don't sell lookup data, and don't enrich them into a public dataset. Guest (no-signup) checkouts tie the report to the Stripe-verified email for the same 30-day window.

Should I use the bulk tool or the API?

The bulk tool is the right choice for one-off lookups, ad-hoc investigations, and teams that don't want to write code. The public IP intelligence API is the right choice when you need ongoing enrichment inside an application, scoring in a real-time fraud flow, or higher throughput than 100 IPs/request. Both tools read from the same enrichment pipeline.

Does it support IPv6?

Yes. Both IPv4 and IPv6 addresses are accepted in the same batch. Results include the same 40+ fields regardless of version, though some fields (e.g. postal code, time-zone) are sparser for IPv6 because the underlying databases have less IPv6 coverage.

Can I paste CIDR ranges instead of individual IPs?

Not directly — the bulk tool expects individual addresses. If you have a CIDR range, use our CIDR to IP range converter to expand it first, then sample or submit the resulting list.

What if the data isn't useful?

Paid bulk reports come with a 7-day money-back guarantee. If the report doesn't match what you expected, email us and we'll refund the purchase — no justification required.