Bulk Bot IP Checker:
Verify a Whole List of Addresses at Once
Paste up to 200 IP addresses straight out of an access log or a spreadsheet and find out which of them are real search and AI crawlers. Every other bulk IP checker returns geolocation — country, ISP, coordinates. Useful, but not the question a log raises. This one compares every address against the live published range files of Google, Microsoft, OpenAI, Anthropic, Perplexity and Common Crawl, and hands back a filtered list of the few worth looking at properly.
Quick Answer: How Do You Check Bot IPs in Bulk?
Paste up to 200 addresses and match them against every crawler operator's published CIDR ranges in one pass. That is the half of verification that scales. Reverse DNS does not scale, so run it only on the addresses this narrows you down to.
Jessica Wright
Cybersecurity Threat Researcher
Jessica works on bot verification and IP reputation, separating traffic that is what it says from traffic that only claims to be.
This page exists because every other verifier I have built says the same thing in its limitations: it checks one address at a time. That is fine when you have one suspicious log line. It is useless when you have four hundred, which is the normal case — nobody investigates a single request, they investigate a day.
The honest constraint is that only half of verification scales. Matching addresses against published ranges is arithmetic and costs almost nothing. Reverse DNS is a network round trip per address with no parallel resolver available, so two hundred addresses would be two hundred seconds. I would rather run the half that works on the whole list and tell you plainly that the other half is waiting on the operator pages, than run something weaker and let it look complete.
Last reviewed 24 August 2026 · 14 vendor feeds read live · Pasted addresses are never stored or logged
View all articles by Jessica WrightWhy Does a Bulk IP Lookup Not Answer This?
Because they were built to answer a different question. Paste a list into any of the popular bulk IP tools and you get country, city, ISP, organisation, ASN, coordinates, sometimes a VPN or datacenter flag. That is genuinely useful data for a fraud review or a geo audit.
It is not what an access log raises. When four hundred addresses turn up in a day claiming to be crawlers, the question is not where they are — it is which of them are real. Geolocation cannot answer that, because a real Googlebot and a scraper renting a machine two racks away return almost identical geolocation.
The only thing that separates them is whether the address appears in the range file the operator publishes about its own infrastructure. That comparison is cheap, and the bulk geolocation tools do not run it.
Who else does run it
Two tools worth knowing about, because a page claiming to be alone in a category usually has not looked. Patrick Stox publishes a bot verifier with a bulk mode that takes up to 500 addresses or raw log lines and a per-row live reverse-DNS spot-check. Vivoldi's search engine bot checker accepts CIDR ranges and covers IPv6 across Google, Bing, Naver and Yahoo. Both are good tools and both are honest about what they cannot confirm.
What this page does differently is narrower than "everything". It reads the vendor feeds live rather than from a weekly snapshot, so a prefix published this morning is matched this morning. It covers fourteen feeds, including OpenAI's four separate files, Anthropic's combined list for ClaudeBot and its siblings, both Perplexity files and Common Crawl's CCBot. And it turns the matches into a prefix allowlist, which is the thing the actual workflow ends in.
The cost of getting it wrong runs in one direction. Imperva has written that accidentally blocking Googlebot loses search rankings that are sometimes worth millions in brand equity built over years. The log analysis vendor JetOctopus reports seeing cases where Googlebot itself was blocked by accident, on large sites, with the consequences that implies. Meanwhile HUMAN Security's two-week measurement across sixteen well-known AI crawlers found 5.7% of traffic claiming to be from them was fake, rising to 16.7% for the ChatGPT user-agent.
So the two failure modes are not symmetrical. Letting a fake crawler through costs you bandwidth and some scraped content. Blocking a real one costs you the index. A tool in this space that reports uncertainty as a negative is more dangerous than useful.
The scale of the problem is not subtle. Industry measurements through 2026 put bots at more than half of all internet traffic, and roughly a fifth of it invalid. Separately, an estimated four in five AI agents do not identify themselves properly when they visit. If you are reading a log by hand, you are not going to work through that volume one address at a time.
Which raises the obvious question of what a bulk check can honestly promise.
What Can a Bulk Bot IP Checker Actually Verify?
Crawler verification has two halves, and only one of them scales.
The half that scales: published ranges
Every major operator except three publishes a machine-readable file of the address ranges its crawlers use. Comparing an address against those files is arithmetic on packed binary — no network call per address, no waiting. Two hundred addresses against roughly a thousand prefixes finishes in well under a second, which is why this page can offer it on a whole list.
The half that does not: reverse DNS
Forward-confirmed reverse DNS is the stronger check, and for Google and Microsoft it is the one the vendor documents first. It is also a network round trip per address. PHP has no parallel resolver, so even bounded hard to one second each, two hundred addresses is two hundred seconds. There is no arrangement of that which finishes inside a web request.
So this page runs the range check on everything and says so, rather than quietly running a weaker check and letting the output look complete. Once the list is narrowed, the addresses that matter go to the operator pages: Googlebot across its five categories, Bingbot where Microsoft's own two checks disagree, or the universal verifier if you are not sure which operator you are looking at.
Three operators cannot be checked here at all. Apple, Amazon and Yandex publish no range file — reverse DNS is their only documented method. An Applebot address will show as no match on this page, and that means unverifiable rather than fake. Do not build a blocklist from the no-match column without reading it that way first.
What to paste
Anything, including raw log lines. Paste an unedited block of Apache or nginx output and the parser takes the addresses and skips the timestamps, methods, status codes and user-agent strings around them rather than reporting them as errors. Commas, spaces, tabs, semicolons, pipes, a spreadsheet column, quoted or bracketed values, IPv4 with a trailing port, IPv6 in [address]:port form — all handled. Duplicates are removed, private and reserved addresses filtered out, and every rejection counted back to you. CIDR ranges can sit in the same list and are matched by overlap — useful because crawler traffic clusters into subnets, so one range often settles dozens of log lines. If you want to expand a prefix first, the CIDR calculator turns it into its full address range.
What Does Each Result Mean, and What Should You Not Read Into It?
The table gives you three outcomes, and the middle one is where people go wrong.
There is a second reason to care which rows are genuine, and it is not security. Search crawlers spend a crawl budget on your site, and a scraper wearing Googlebot's name is spending your server capacity without any of the return. Full log file analysis — which URLs get crawled, how often, how much budget goes to pages you do not care about — is a bigger job than this page does, but it starts with knowing which lines in the log were really the crawler they claimed to be.
The no-match column is not a blocklist. Four different situations land in it and only one of them is a forged crawler. Microsoft's published file has not been revised since January 2024. Perplexity declares thirty-two addresses in total. None of the files include addresses an operator has used and released, so an old log entry can produce a match failure that means nothing at all.
What separates those cases is not the address, it is behaviour and ownership. An ASN lookup names the network announcing an address, which is usually the fastest way to tell a cloud-rented scraper from a search engine. A datacenter check confirms whether it is rented space at all, and a blacklist check shows whether the address already has an abuse history worth knowing about.
The allowlist is the point
Search Engine Land's guidance on Googlebot fraud is blunt about the maintenance job this creates: if a crawler starts using a new address or route, a WAF can block it by mistake, so you should review firewall logs regularly and update allowlists when needed. That is a bulk task by definition. Nobody reviews a firewall log one address at a time.
It is also why the results above collapse into a prefix list rather than stopping at the row-by-row table. Sixty verified addresses from a day of crawling usually come from a handful of published prefixes, and a prefix is what a firewall rule is written in. The allowlist panel gives you those lines grouped by operator, ready to paste.
One caution on that. A prefix appears in the allowlist because one address inside it turned up in your list. Allowlisting the whole prefix trusts every address in it — which is what the operator intends, since they published it — but it is a wider grant than the single row it came from. That trade is usually right for a search crawler and worth thinking about for anything else.
A workflow that holds up: paste the log's unique addresses here, export the CSV, filter to the no-match rows, run those through an ASN lookup, and only then decide anything. Once you know what you want to allow, the crawler blocker writes the robots.txt and firewall rules from the same live ranges this page just matched against.
What this tool cannot do
Bulk trades depth for breadth, and it is worth being explicit about what gets traded away.
No reverse DNS
The stronger of the two checks, and the one Google and Microsoft document first, is a network round trip per address. It cannot run two hundred times inside a page load, so it does not run here at all.
Three operators are invisible
Apple, Amazon and Yandex publish no range file. Their crawlers land in the no-match column, which means unverifiable here rather than fake, and treating that column as a blocklist would catch them.
It cannot see your user-agents
You paste addresses, not log lines. The tool cannot tell you that an address claimed to be Googlebot, which is exactly the mismatch worth catching. Keep the user-agent column beside the address in your own spreadsheet.
No historical record
Every file describes the addresses in use now. An address a crawler used last year and has since released reads as no match, so old log entries produce false negatives that nothing here can correct.
200 addresses a run
The cap is about keeping the page responsive rather than the matching itself, which is fast. For a larger list, deduplicate to unique addresses first — a day of crawler traffic usually collapses to far fewer than you expect.
A match is ownership, not welcome
Confirming an address belongs to a crawler settles identity and nothing else. How hard it is crawling you and which paths it hits are separate questions, and usually the answer is a crawl rate setting rather than a block.
When an address comes back with no match and you want to know what it actually is, a reverse IP lookup shows what else is hosted there — a shared host full of unrelated domains reads very differently from a lone crawler machine.
And the guide to IP spoofing covers why a spoofed user-agent costs an attacker nothing, and why a header is never identity.
Frequently asked questions about bulk bot IP checking
How do I check a lot of bot IP addresses at once?
Paste them into the box above — one per line, comma separated, or straight out of a spreadsheet or a log file. Up to two hundred addresses run in a single pass, and CIDR ranges can be mixed into the same list. Every address is checked against the live published range files of fourteen crawler feeds from Google, Microsoft, OpenAI, Anthropic, Perplexity and Common Crawl.
Why do the popular bulk IP tools not tell me about bots?
Because they are geolocation tools. Paste a list into one and you get country, city, ISP, ASN and sometimes a VPN flag — useful data, but not an answer to the question an access log raises. They do not compare addresses against crawler operators’ published ranges, which is the only thing separating a real search bot from something using its name. A couple of tools outside that group do run the comparison, and they are named in the first section rather than ignored.
Can I paste raw access log lines?
Yes. Paste an unedited block of Apache or nginx output and the parser takes the addresses and skips the timestamps, request methods, status codes and user-agent strings around them. Those are counted separately as log noise rather than reported as errors, so a clean paste does not come back looking like it failed.
Does this run reverse DNS on every address?
No, and that is a deliberate limit rather than an oversight. PHP has no parallel DNS resolver, so even bounded to one second each, two hundred addresses would take two hundred seconds. Bulk mode runs the published-range check only. For the handful of addresses that matter, open the operator page linked beside each result — those run forward-confirmed reverse DNS properly.
Can this verify Applebot, Amazonbot or YandexBot?
No. Those three publish no machine-readable range file at all, so there is nothing for a bulk check to compare against. Reverse DNS is the only documented method for them, and bulk mode cannot run it. An address from one of those crawlers will show as not matched here, which means unverifiable rather than fake.
What does it mean when an address matches two crawlers?
That the operator publishes overlapping files. GPTBot and OAI-SearchBot share several prefixes, and Anthropic publishes one combined file covering three agents. The address is confirmed as that operator’s; which specific crawler sent the request is not answerable from the address alone. Read the user-agent on the same log line for that.
Is a non-match proof that an IP is a fake bot?
No. It means the address is in none of the range files that loaded on this run. Some operators publish nothing to match against, some publish lists that are years out of date, and none of the files include addresses an operator has retired. A match is strong evidence; a miss is a prompt to look more closely, not a verdict.
Do you store the IP addresses I paste?
No. The list is parsed in memory to produce the table, and nothing about it is written to disk or logged. The vendor range files are cached server-side; your input is not part of that cache.
Can I export the results?
Yes. The Download CSV button builds the file in your browser from the table already on screen — no second request, and the list never makes another trip to the server. It opens straight into a spreadsheet for filtering or for pasting into a firewall change ticket.
Related IP & crawler tools
Bulk narrows the list. These settle the addresses that matter.
Browse the full set on the TrustMyIP tools directory.
Narrowed the list? Now decide what to allow
The blocker writes robots.txt and firewall rules from the same live vendor ranges this page just matched against, and warns you when a rule aimed at one crawler would take another down with it.
Last updated 24 August 2026 · 14 vendor feeds read live · Pasted addresses are never stored or logged