How this tool works
Paste your addresses into the box, one per line or separated by spaces and commas, and press Look up. The tool reads every line, pulls out the first address it finds and discards whatever surrounds it: ports, user names, passwords, protocol prefixes, square brackets around IPv6 addresses and CIDR masks. Duplicate addresses are collapsed so a list of 100 lines with 60 unique IPs produces 60 rows. Entries that contain no address at all, such as hostnames, stay in the table marked invalid, so you can see what was skipped without counting lines by hand.
Every valid address is then matched against the same local datasets that power the single IP lookup: the DB-IP city database for country, region and city, the iptoasn routing snapshot for the announcing ASN and its registered name, the ipcat list of datacenter ranges, the current Tor exit node list and the Spamhaus DROP list. Because these datasets live on our own server, a batch of 100 addresses is normally answered in well under a second. The network type (residential ISP, mobile carrier, hosting, VPN provider, education, government, business) is derived from the network name and the datacenter list, which is the same classification used everywhere else on the site.
Two columns go beyond what a plain geolocation table gives you. The Native column compares the country the regional registry allocated the block to with the country the address is geolocated in and labels the address Native IP when they agree and Broadcast IP when they differ. The registry country comes from RDAP, with the RIPEstat whois service as a fallback, and is cached for a day per address, so a list that was checked before comes back instantly and a brand-new list of 100 addresses may take a few seconds while the registries answer. The Score column is the purity score described below.
How to read the result
The summary chips at the top count the batch: how many addresses were valid, how many landed in the clean, suspicious and risky bands, how many are broadcast addresses, Tor exits or hosting ranges, and how many entries could not be parsed. The country chips show the distribution, which is the fastest way to confirm that a proxy list advertised as "US residential" actually resolves to the United States, and to ordinary ISPs rather than cloud providers.
The table has one row per address. Click any column header to sort: by score to find the weakest addresses first, by country to group a mixed list, by network to spot how many addresses share one ASN. The Flags column shows pills for Tor, Spamhaus DROP, hosting, VPN-provider and mobile. The Type column is the classification; residential and mobile are what most websites expect from a real user, hosting and VPN are what they challenge. Every IP links to its full profile page, where the reverse DNS, WHOIS record, BGP origin, RPKI status and the complete list of score deductions are shown.
The Score pill summarises the purity score. The score starts at 100 and subtracts a fixed weight for each signal: 40 for a Tor exit, 30 for a Spamhaus DROP block, 25 for a datacenter or hosting range, 15 for VPN or proxy keywords in the network name, 10 for a broadcast verdict, 8 per DNS blocklist hit (capped at 24), and small deductions for a missing reverse DNS or a missing abuse contact when those were checked. Hover over the pill to see which deductions applied. The bands are deliberately simple: 80 and above is clean, 50 to 79 suspicious, below 50 risky. A clean score does not promise that an address will pass every anti-fraud system, and a suspicious score on a mobile carrier address usually just reflects carrier-grade NAT, which is why the reasons are always listed rather than hidden behind a number.
If you tick Also query DNS blocklists, the first 20 IPv4 addresses are checked against eight public blocklists (Spamhaus ZEN, SpamCop, Barracuda, SORBS, UCEPROTECT, PSBL, s5h and DroneBL). The Lists column then shows listed/checked for those rows, and a listing lowers the score. IPv6 addresses and addresses beyond the first 20 keep a dash in that column; run them in a separate batch if you need them all.
What to do next
You are evaluating a proxy or VPN list before buying or using it
Paste the list exactly as the seller delivered it. Look at the country chips first: they tell you whether the geography matches the offer. Then sort by type. A "residential" package that is mostly hosting or VPN-provider networks is not what it claims to be, and a package that is genuinely residential will be dominated by ISP and mobile carrier types with native verdicts. Sort by score last and look at the risky rows individually; a few Tor exits or DROP-listed addresses in a large list are a sign the seller recycles abused ranges. For the addresses you intend to rely on, open the proxy checker through the proxy itself to see what a strict website observes from the inside.
You are triaging a server log or a firewall report
Extract the client addresses, paste them, and sort by score. The risky band collects Tor exits, DROP blocks and blocklisted addresses, which are the obvious candidates for a block rule. The suspicious band is where scrapers and bots on cloud providers usually sit: hosting ranges from a handful of large ASNs. The clean band on ISP and mobile networks is your real users; block those only with evidence from the log itself. Download the CSV and keep it next to the log so the decision can be reviewed later.
You manage address space or audit a network
Paste the addresses of your own servers and mail relays. Any row with a blocklist hit, a missing reverse DNS or a broadcast verdict that surprises you deserves a look: the first two affect email deliverability directly, the third means the geolocation databases place your block somewhere other than where it is registered, which is worth correcting with the providers. The per-IP page shows the RPKI status of the covering prefix, so a quick pass over the list also tells you whether your routes are protected by ROAs.
Limits of this tool
Geolocation is country-accurate and usually right at the city level, but it is not a street address and it is derived from registry data and routing, not from the device. The classification is a heuristic built from network names and curated lists; a small hosting provider with a bland name can be classified as unknown, and a few ISPs that also sell servers are flagged as hosting. The native/broadcast verdict depends on the registry publishing a country for the block, which ARIN does not always do at the network level; those rows show Unknown rather than a guess. The purity score is built from free public datasets only. Commercial reputation feeds that score individual addresses by observed abuse (IPQualityScore, IP2Proxy, GreyNoise) see things these datasets cannot, and a residential proxy on a real ISP line will score clean here because, from the outside, it is one.
The batch size and rate limits exist to keep the tool fast for everyone; the JSON API carries the same limits and is the better route for anything automated. Nothing you paste is stored, and the export is generated in your browser from the data already on the page.