Bulk IP geolocation
Geolocate up to 50 IP addresses or log lines at once — country, city, ASN/ISP, VPN/hosting and abuse signals in one table, with CSV export.
How this tool works
Bulk IP geolocation processes a whole list of IP addresses at once: paste IPs line by line, comma-separated or directly as log lines — the tool extracts the contained addresses and returns country, city, ASN/provider plus VPN, hosting and abuse signals per IP in a table. The result can be exported as CSV with one click; the CSV file is generated entirely in the browser and not uploaded. Up to 50 IPs are evaluated per query; with more addresses the list is capped and a corresponding notice is shown. Geo data is an estimate from open sources.
Typical use cases
- Geographically classify a list of login or order IPs from the log in one pass
- Group suspicious IPs from a security incident collectively by country and ASN
- Estimate the hosting and VPN share in a visitor IP list to assess bot traffic
- Export results as CSV and process them further in a spreadsheet or SIEM
- Quickly check which countries a series of accesses originate from
Frequently asked questions
How many IP addresses can I check at once?
Up to 50 per query. If you enter more, the list is capped to the first 50 and a notice is shown. For larger or continuous evaluations we recommend the authenticated XICTRAQ geo API.
Which input formats are recognized?
IPv4 and IPv6, line by line, comma-separated or embedded in log lines. The tool extracts the contained addresses automatically, so you can paste raw log lines.
Is the CSV file uploaded anywhere?
No. The CSV export is generated solely in your browser from the already displayed results and offered as a download — no additional upload happens.
How accurate is the geolocation?
It is an estimate from open IP-geo sources. Usually reliable at country level, coarser at city level; with VPNs, cellular or carrier-grade NAT it can deviate from the actual location.
Are the entered IP lists stored?
No. The list is processed for evaluation and not stored for tracking purposes. The page sets no cookies; our own cookieless reach measurement records no values you enter.
What do the VPN and hosting columns mean?
They show per IP whether anonymizing or data-center attributes were detected. These are hints for further assessment, not a final verdict about the respective address.
Related tools
IP address check
Full geo, network and risk profile for any IP.
IP reputation & abuse score
Reputation estimate with abuse score and risk signals.
VPN & proxy detection
Signals for VPN, Tor, relay and hosting IPs.
ASN & network lookup
IP, CIDR or ASN to organization, network, RIR and hosting.
IP blacklist check
16 public DNSBLs in one pass.
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.