If you have one IP address, a single lookup is easy. But what if you have a thousand? Or ten thousand? Checking each one by hand isn’t practical. You need a way to look up many IPs at once and get clean, structured data back for each one.
That’s where bulk IP lookup comes in. It lets you take a list of IP addresses and retrieve location and network details for all of them in one go.
In this guide, you’ll learn two ways to handle bulk IP lookups: a no-code option for quick checks and an API-based approach for larger workloads. We’ll also walk through a working Python script you can use right away.
Key Takeaways
- Bulk IP lookup means checking a bunch of IP addresses at once instead of doing them one by one.
- You have two options: upload a CSV if you want to keep things simple, or use the API if you’re working with a larger list.
- The no-code option works well for small, one-off lists, like marketing signups.
- The API option makes more sense when you need to process larger lists or fit lookups into an existing workflow.
- With a simple Python script, you can turn a CSV of IPs into a file with country, city, and ISP data.
Let’s look at both options and see which one works for you.
Short Answer: Two Ways to Do It
There are two main ways to do this, and the right one depends on how many IPs you have and whether you want to use code.
If you have a small list and don’t want to write code, upload a CSV and get the results back. Simple and quick. If you’re working with a larger list or want to automate the process, use the API from a script. You get more control and can fit it into your existing workflow.
Both options use the same IP Lookup API. The only difference is how you run the lookups.
Let’s start with the simpler option.
The No-Code Way (Upload a CSV)
This option is for anyone who wants results quickly without writing any code.
You take your list of IP addresses, save it as a CSV, and upload it for a simple CSV IP lookup. The tool processes each IP and adds details like country, region, city, and ISP. Once it’s done, you get a complete table that you can view or download.
This works well when you have a short list, maybe from a contact form, a signup page, or a log file you exported once. You do not need an account setup or code editor. Just drop the file in and wait for the table to fill up.
There are limits, though. This approach isn’t meant for huge files or scheduled lookups. If you need to process large lists regularly, the API option is a better fit.
The API Way (for Scale)
Once your list gets bigger, or you need to run the same lookup regularly, the API is the better fit.
The idea is simple. You send an IP address to the API, and it returns a JSON response with location and network details. To process a full list, your script loops through the IPs, makes the requests, and saves the results. This batch IP lookup approach is useful when you need to process larger lists or run lookups regularly. You can run this on your machine, on a server, or as part of a larger data pipeline.
API Endpoint (Base URL)
dig -x 8.8.8.8 +shortThis queries the DNS system for the IP’s PTR record and may return a hostname such as:
dns.google.Note that this gives you the hostname associated with the PTR record, not a list of domains sharing the IP. That’s the reverse DNS side of things, not reverse IP.
Where a full domain list comes from
Getting a list of domains associated with an IP means querying a service that maintains an indexed reverse-IP database, built from sources such as crawling and tracking domain-to-IP mappings over time. That’s a different kind of service from a standard IP lookup API, and it’s worth knowing the difference before you go looking for one.
A plain IP lookup API, including IPstack, isn’t designed to return a list of domains associated with an IP. Its job is to take an IP and return information such as location and network data.
Reverse DNS through an API
What an IP lookup API can do in code is the reverse DNS side, returning the PTR hostname alongside other IP information. Here’s a basic request using IPstack’s endpoint with hostname lookup enabled:
<https://api.ipstack.com/{ip_address}?access_key=YOUR_ACCESS_KEY>
Here is a simple Python script that does exactly that. It reads a CSV of IPs, looks up each one, and creates a new CSV with the results.
import csv
import time
import requests
API_KEY = "YOUR_ACCESS_KEY"
INPUT_FILE = "ip_list.csv"
OUTPUT_FILE = "ip_list_enriched.csv"
REQUEST_DELAY = 0.5 # seconds, adjust based on your plan's rate limit
def lookup_ip(ip_address):
url = f""
params = {"access_key": API_KEY}
response = requests.get(url, params=params)
data = response.json()
return {
"ip": ip_address,
"country": data.get("country_name", ""),
"city": data.get("city", ""),
"isp": data.get("connection", {}).get("isp", "")
}
def main():
with open(INPUT_FILE, newline="") as infile:
reader = csv.reader(infile)
ip_list = [row[0].strip() for row in reader if row]
results = []
for ip in ip_list:
try:
result = lookup_ip(ip)
results.append(result)
print(f"Looked up {ip}")
except Exception as error:
print(f"Failed on {ip}: {error}")
time.sleep(REQUEST_DELAY)
with open(OUTPUT_FILE, "w", newline="") as outfile:
writer = csv.DictWriter(
outfile,
fieldnames=["ip", "country", "city", "isp"]
)
writer.writeheader()
writer.writerows(results)
print(f"Done. Results saved to {OUTPUT_FILE}")
if __name__ == "__main__":
main()
The script keeps things simple on purpose. It reads the input file, adds a small delay between requests, and writes the results to a new CSV with country, city, and ISP. You can build on it later by adding retry logic or pulling in more fields like region or timezone.
Now that the basic workflow is covered, let’s look at some common use cases for bulk IP lookup.
Use Cases
Bulk IP lookup can be useful in more situations than you might expect:
- Fraud and risk checks: If you run an e-commerce or fintech platform, you can check a batch of signup or transaction IPs against their location, and flag ones that don’t match the expected region.
- Marketing and analytics: If you have a list of website visitor IPs from your logs, bulk IP geolocation helps you understand where your traffic is really coming from, beyond what your analytics tool shows by default.
- Server and network audits: If you manage infrastructure, you can run a list of server or client IPs through bulk lookup to confirm ISP and location details match your records.
- Data enrichment for CRM lists: If your CRM has IP addresses tied to leads or sign-ups, running them through bulk lookup adds location context you can use for segmentation.
The basic idea stays the same across all of these. Use the no-code option for quick, smaller lists and the API when you need to process larger lists or automate the work.
Conclusion
Checking IPs one at a time doesn’t scale, but bulk IP lookup makes the process much easier. For a quick, one-off list, the no-code CSV option gets the job done. For larger or recurring lookups, the API and Python script give you more control and make it easier to automate the process.
If you just have a list to check today, start with the free bulk lookup tool. If you’re a developer building this into your own workflow, the batch API and the script above will get you there. Check out the real-time IP lookup API to get your free API key and start building.
Frequently asked questions
How many IPs can I look up at once?
It depends on your plan and the method you use. The no-code option works best for smaller lists, while larger lists are better handled through the API. With the API, the practical limit depends on your rate limit and how long the script takes to run.
Do I need to write code to do a bulk lookup?
No. For smaller lists, the CSV upload doesn’t require any code. Code is useful when you need automation, larger batches, or integration with your own systems.
What data do I get back for each IP?
You can get details such as country, region, city, latitude, longitude, and connection information like ISP. The available fields depend on your plan.
Can I schedule bulk lookups to run automatically?
Yes. With the API approach, you can run the script on a schedule using a cron job, scheduled task, or as part of a larger pipeline.
What happens if an IP address is invalid?
The API returns an error for that IP. In the example script, the error is caught and logged, so one invalid IP doesn’t stop the rest of the list from processing.
Try ipstack free
IP-to-location, ASN, ISP, time zone and threat data from one endpoint. Get a key and make your first call in under a minute.
Dynamic IP Address
Giving models real location data instead of a training cutoff — the ipstack MCP server, agent tool use, and how the current LLMs handle the API.
