IP Range Counter | Count IPs by /16, /24 Range and Address

IP range stats

Paste a pile of IPs to see which /16 and /24 ranges they cluster in, and which addresses appear most. Commas, spaces, tabs and line breaks can be mixed.

IPv4 found: 0

Text to analyze

Counting happens in your browser. What you paste is not uploaded.

How the counting works

Three levels, each sorted by number of occurrences, highest first.

How IPs are extracted
Only valid IPv4 addresses count: all four numbers between 0 and 255, with no extra digits or dots stuck to either end, so 999.1.1.1 and 1.2.3.4.5 are ignored. Commas, spaces, tabs and line breaks can be mixed, and an address followed by a port (1.2.3.4:80) or written as CIDR (10.0.0.0/8) is picked up as the address in front.
/16 range, /24 range and exact address
A /16 range is the first two numbers (such as 10.1.*.*), a /24 range is the first three (such as 10.1.2.*), and the exact address is the full IP such as 10.1.2.3. Chinese-speaking admins call these the B, C and D segments. Open a /16 or /24 row to see the unique IPs inside it, sorted by value.
Large inputs are fine
Cards start collapsed and rows and details load in batches (100 rows first, then 300 more each time), so tens of thousands of lines won't freeze the page. Copy these ranges and Copy details always copy the full result, not just what is displayed.
Nothing is uploaded or stored
Extraction and counting run in your browser. What you paste is never sent to a server and is not written to local storage either; it is gone when you refresh or close the page. Logs and block lists full of visitor IPs are safe to paste.

How to use it

Paste any text that contains IPs into the box: a log excerpt, a block list, a spreadsheet column. Commas, spaces, tabs and line breaks all work. With nothing to hand, press Fill sample to try it.
Press Analyze. The line at the top shows how many IPv4 addresses were found and how many are unique, and three cards appear below: /16 ranges, /24 ranges and exact addresses.
Open a card to see how often each range appears. Open a row in the /16 or /24 card to see which IPs it contains, and press Show more to load further rows.
Use Copy these ranges on a card for its list of ranges, or the copy icon on a row for the IPs inside. For reports press Export CSV to get all three levels at once. Collapse all and Clear bring you back to the start.

Results and features explained

What every number and button on the page means.

IPv4 found: How many IPv4 addresses were recognised in total (an address that appears three times counts three times), with the number of unique addresses in brackets.
/16 range (a.b.*.*): Grouped by the first two numbers, so each group is a /16 that can hold up to 65,536 addresses. N times is the sum of occurrences of all IPs inside it, and M IPs is the number of unique addresses.
/24 range (a.b.c.*): Grouped by the first three numbers, a /24 that holds up to 256 addresses. When you trace scanning or credential-stuffing traffic, many addresses in the same /24 usually mean one source.
Exact address (a.b.c.d): No grouping: one row per distinct address with its occurrence count. Useful for finding the single busiest IP.
Sort order: Every card is sorted by occurrences, highest first, with ties ordered by address. The IPs inside an expanded row are unique and sorted by numeric value.
Copy these ranges / Copy details: The first copies the card's list of ranges, one per line (for example 10.1.*.*); the second copies every IP under one row. Both copy the full result regardless of how many rows are shown, and a small toast confirms it.
Export CSV: One file with all three levels. Columns are level (B, C or D), range, occurrences and distinct_ips. It has a UTF-8 BOM so Excel opens it without garbled characters.
Collapse all, Clear, Fill sample: Collapse all closes every open card; Clear empties both the input and the results; Fill sample puts a few lines of example addresses in the box so you can try the tool. The sample uses reserved documentation ranges, not real visitors.

IP range stats FAQ

What do B, C and D segments mean?

They are the names Chinese-speaking admins use for parts of an IPv4 address, counted from the left: the B segment is the first two numbers (10.1.*.*, a /16 range), the C segment is the first three (10.1.2.*, a /24 range) and the D segment is the full address. They are not the old class A, B and C networks.

What is the difference between occurrences and IP count?

Occurrences is how many times the IPs show up in your text (an address that appears three times counts three times). IP count is how many different addresses there are. The line at the top of the tool shows both.

How do I count IPs by /24 to find the busiest sources?

Paste the IP column of your log or your block list, press Analyze and open the /24 card. The range at the top is the /24 with the most occurrences. Expand it to see which addresses it contains, then use Copy these ranges to take the result into a firewall rule or an investigation.

Does it support IPv6?

Not yet. Only IPv4 is counted. IPv6 addresses are ignored and not split into ranges.

Is my pasted text uploaded?

No. Extraction and counting run in your browser, and this page has no server endpoint for them. The text is gone once you refresh or close the page.

Some addresses are missing or extra. What should I check?

Check whether an address has a leading zero (01.2.3.4) or a number above 255; those are treated as invalid and ignored. An address stuck directly to other digits or dots is not recognised either, so put a space or comma around it and try again.