IP lookUp IP lookUp

Bulk IP List Tools

Paste a list of IP addresses or CIDR blocks below to deduplicate it, sort it numerically, aggregate it into the smallest set of CIDR blocks, expand a CIDR block into individual addresses, diff it against a second list, or filter out private and bogon addresses — five of these six operations run entirely in your browser with zero network requests.

How private is this?

Deduplication, numeric sort, CIDR aggregation, CIDR expansion and the two-list diff are entirely local: whatever you paste into this page for those five operations is processed only in your browser and is never sent anywhere. The filter operation's default, local classification (private / bogon / globally routable) works the same way.

The filter operation has one optional extra step: a live check against fresher unassigned-address data. It only runs after you explicitly click its confirm button below the filter results, and even then it sends only the specific addresses you're checking — never anything else on the page — and receives back nothing more than a bogon/unassigned flag for each one.

Bulk IP List Tools

Every operation on this page works on a pasted list of IP addresses and CIDR blocks, not a single address at a time. The most common mistake tools in this space make is sorting that list as plain text: alphabetically, "10.0.0.10" sorts before "10.0.0.2" because the character "1" is less than "2", even though 10.0.0.2 is the numerically smaller address. This page's sort operation always compares the 32-bit (IPv4) or 128-bit (IPv6) integer value of each address instead, so a list like 10.0.0.2, 10.0.0.10, 10.0.0.100 comes back in the order a network engineer actually expects, not the lexicographic order a naive string sort would produce.

Deduplication removes exact repeats after normalizing each entry: an IPv6 address written two different ways (2001:db8::1 and its fully expanded form) is recognized as the same address and kept only once. Aggregation goes further and collapses a list of CIDR blocks, or plain addresses treated as their own /32 or /128, into the smallest equivalent set, merging any pair that is adjacent or overlapping, so 10.0.0.0/25 and 10.0.0.128/25 become 10.0.0.0/24. This is the same route-summarization principle a router or firewall uses to keep an ACL or route table small: fewer, larger entries are both faster to evaluate and easier to audit than the same address space spelled out as many small blocks.

CIDR expansion runs the opposite direction: it lists every individual address inside a block, useful for feeding a tool that only understands flat address lists. Because a /8 expands to over 16 million lines, expansion checks the total count before generating anything and refuses outright once it would exceed a fixed limit, rather than freezing the tab half-way through. The diff operation compares two pasted lists, a common "what changed between two snapshots" question, and reports the classic three-way split: addresses only in the first list, only in the second, and present in both, which is usually more useful than a single equal-or-not answer when auditing a firewall rule set or an allowlist over time.

The filter operation classifies every address as private (RFC 1918 space like 10.0.0.0/8), bogon (reserved ranges that should never appear on the public internet, such as 0.0.0.0/8 or the IPv6 documentation range 2001:db8::/32), or globally routable. That classification is entirely local by default: it runs in your browser against a small, fixed table generated directly from this service's own IP-classification code, so it works instantly with zero network requests, even offline. A second, optional layer exists for addresses that classify as globally routable locally but may in fact be unassigned space the regional internet registries haven't delegated yet; that full unassigned-space dataset is several megabytes and this page deliberately does not ship it to your browser for free. Instead, if you explicitly opt in, the exact addresses you're checking, never the whole list, only the ones not already known, are sent to our server in small batches, and we return nothing more than a bogon or unassigned flag for each, no geolocation, no ASN, no threat data. That request only ever happens after you click the confirm button below the filter results; switching to the filter tab, or typing into the list, never contacts our server on its own.

Privacy is the reason this page exists as a client-side tool rather than a form that posts your list to a server: deduplicating, sorting, aggregating, expanding and diffing a list of IP addresses, often a customer list, an attacker log, or an internal network map, never leaves your browser for any of those five operations, and the filter's local classification doesn't either. The one exception is opt-in and narrow by design, described above and repeated in plain terms right next to the confirm button, so you always know exactly what would be sent before you ever send it.

Glossary

Deduplication
Removing repeated entries from a list after normalizing each one to its canonical text form, so two different textual spellings of the same address are recognized as one.
Numeric IP sort
Ordering addresses by their actual 32-bit (IPv4) or 128-bit (IPv6) integer value, not as plain text — the only sort order where 10.0.0.2 comes before 10.0.0.10.
CIDR aggregation
Collapsing a list of CIDR blocks into the smallest equivalent set by merging any pair that is adjacent or overlapping, without changing which addresses are covered.
Bogon address
An address in a reserved range that should never appear as a real source or destination on the public internet — loopback, link-local, multicast, or a documentation range like 2001:db8::/32.
Private address
An address in one of the ranges RFC 1918 (and its IPv6 equivalent, RFC 4193) reserves for internal networks — never routable on the public internet, but common behind NAT.
Unassigned address space
A range of otherwise ordinary-looking, globally-routable-format address space that the regional internet registries have not yet delegated to anyone — detectable only from a live, regularly-updated dataset, not from a static table.

Frequently asked questions

Why does the sort operation use numeric order instead of alphabetical?
Because sorting IP addresses as plain text gives the wrong order: alphabetically, 10.0.0.10 comes before 10.0.0.2 since the character "1" sorts before "2". This tool always compares each address's actual 32-bit or 128-bit numeric value, so 10.0.0.2 correctly comes before 10.0.0.10.
What counts as a private address versus a bogon address?
Private addresses (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and their IPv6 equivalent fc00::/7) are reserved for internal networks and are expected to appear behind NAT. Bogon addresses are a broader reserved set that should never appear as a source or destination on the public internet at all — loopback, link-local, multicast and documentation ranges like 2001:db8::/32 are among them. Both are flagged by the filter operation, with the specific reason shown for each address.
Is it safe to paste an internal or customer IP list into this page?
For every operation except the optional live filter check, yes — deduplication, numeric sort, aggregation, CIDR expansion and diffing run entirely in your browser and never send your list anywhere. The one exception is the filter's optional live check, which only runs after you explicitly click its confirm button, and only sends the specific addresses being checked, receiving back nothing more than a bogon/unassigned flag.
What happens if I paste a very large list?
Input is capped at a fixed number of lines; pasting more shows a warning and only the first lines are processed, so the tab never hangs trying to parse an unbounded list. CIDR expansion has its own, tighter limit, checked before any address is generated, since a single /8 block alone expands to over 16 million lines.
Does the filter operation ever contact your server automatically?
No. Switching to the filter tab, or editing the list while it's selected, only ever runs the local, offline classification. The live check that adds fresher unassigned-space data is a separate, explicit action: it requires clicking its own confirm button, which states plainly that your addresses will be sent.
What's the difference between this page and your paid bulk IP API?
This page's live check answers one narrow question — bogon, unassigned, or not — for a batch of addresses, and returns nothing else. Our metered API can enrich a list with full geolocation, ASN and threat data per address for a real B2B bulk-lookup use case — see the business API page for that.

API equivalent

Every operation on this page runs entirely in your browser except the filter's optional live check. For a single address's full network/registry facts server-side, our main API returns the same kind of data this page's filter classifies locally:

curl 
curl "https://ip.xakki.pro/api/v1/ip?ip=8.8.8.8&include=network"

Example response (trimmed):

{
  "schemaVersion": 15,
  "status": "ok",
  "ip": "8.8.8.8",
  "version": 4,
  "flags": {
    "isPrivate": false,
    "isBogon": false,
    "isUnassigned": false
  }
}

What the live filter check actually sends

The one request this page can make, and only after you click the confirm button, is a direct call to the same batch endpoint used above:

curl 
curl -X POST "https://ip.xakki.pro/api/v1/tools/bogon-check" \
  -H "Content-Type: application/json" \
  -d '{"ips":["8.8.8.8","203.0.113.5"]}'
{
  "results": [
    { "ip": "8.8.8.8", "unassigned": false, "class": "global" },
    { "ip": "203.0.113.5", "unassigned": true, "class": "bogon" }
  ]
}

For real bulk enrichment of a list with full geolocation, ASN and threat data per address, see the business API page — this page's live check deliberately returns only a bogon/unassigned flag, nothing more.

Read the full API docs Business bulk IP API

Like this tool? Our API gives free accounts 1,000 requests/day.See the API docs →