Bulk IP Geolocation & Risk Lookup

Resolve public IPv4 and IPv6 addresses into structured geolocation, network, timezone, and risk data. Submit a list of IPs and receive export-ready Dataset rows with clear uncharged error reporting when an address cannot be resolved.

What this Actor does

Bulk IP Geolocation & Risk Lookup returns country, city, coordinates, ASN, organization, ISP, timezone, and indicators for mobile, VPN, Tor, and datacenter networks, plus the isProxy risk flag. It validates public IPs, can remove duplicates before lookup, and isolates individual failures so a bad address does not have to stop the whole batch.

Use cases

• Enrich security, access, fraud-review, or infrastructure logs with IP context.
• Segment traffic by country, region, city, ISP, or autonomous system.
• Flag VPN, Tor, mobile, or datacenter addresses and inspect isProxy for further review.
• Add geographic and network fields to analytics or lead datasets.

How to use

1. Open the Actor in Apify Console.
2. Add public IPv4 or IPv6 addresses and keep deduplication enabled unless repeated rows are required.
3. Click Start and open the Dataset when the run finishes.

Input

ips is required and accepts 1 to 100,000 IPv4 or IPv6 strings. deduplicate defaults to true and removes repeated addresses before requests. continueOnError defaults to true, which writes failed inputs as uncharged error rows and continues processing the rest. Private, reserved, invalid, and scoped addresses do not produce successful intelligence results. Inputs are normalized before lookup; duplicate normalization can reduce the number of requests and output rows.

{
  "ips": [
    "1.1.1.1",
    "8.8.8.8",
    "2001:4860:4860::8888"
  ],
  "deduplicate": false,
  "continueOnError": true
}

Output

Each Dataset item contains the submitted IP, success status, available network and location details, risk indicators, and nullable error fields. This is the complete Dataset item from a real successful run:

{
  "ip": "1.1.1.1",
  "ok": true,
  "asn": "AS13335",
  "organization": "Cloudflare, Inc.",
  "isp": "Cloudflare, Inc.",
  "country": "Australia",
  "countryCode": "AU",
  "city": "Sydney",
  "state": "New South Wales",
  "zipcode": "1001",
  "latitude": -33.854548400186665,
  "longitude": 151.20016200912815,
  "timezone": "Australia/Sydney",
  "localtime": "2026-10-22T03:42:27",
  "isMobile": false,
  "isVpn": false,
  "isTor": false,
  "isProxy": false,
  "isDatacenter": true,
  "riskScore": 20,
  "errorCode": null,
  "errorStatus": null,
  "errorMessage": null
}

For failed inputs, ok is false, available intelligence fields are null, and the error fields explain the failure. Results can be exported as JSON, CSV, Excel, XML, or JSONL.

Pricing

Each successfully resolved public IP triggers one ip-resolved event. Your Apify subscription tier determines its price:

Apify user tier	Price per resolved IP	Equivalent per 1,000 resolved IPs
Free	$0.0005	$0.50
Bronze	$0.00045	$0.45
Silver	$0.0004	$0.40
Gold	$0.000375	$0.375
Platinum	$0.000375	$0.375
Diamond	$0.000375	$0.375

The 1,000-IP amounts are comparison equivalents; Apify charges each successful IP individually. With deduplicate: false, each successfully delivered occurrence is billable, including repeated addresses. Invalid, private, reserved, scoped, or failed addresses returned as error rows do not create this event. The current Pricing tab on the Actor page is authoritative.

Related Actors

Actor	Best for
Website Technology Lookup – CMS, Hosting & Tech Stack Data	Add published CMS, hosting, and technology data for associated websites.
Subdomain Finder – Certificate Transparency	Discover public subdomains for associated domains before further asset research.

Limits and data quality

The Actor accepts at most 100,000 submitted IP values per run. Geolocation and risk attributes are intelligence estimates, not proof of a person's physical location or behavior. Mobile networks, VPNs, carrier-grade NAT, cloud infrastructure, and reassigned address blocks can reduce precision. Fields can be null when the source has no value. Risk indicators and scores can change over time, and city-level coordinates should not be treated as an exact device location. Deduplication changes the number of output rows when repeated inputs are submitted. A run can finish with partial results when the source remains unavailable, the run approaches its time limit, or its spending limit is reached. Check the OUTPUT record: status distinguishes complete, partial, and stopped outcomes; allInputsProcessed reports whether every input was processed. completed is true only when all inputs were resolved successfully.

Frequently asked questions

Can I submit private IP addresses?

They can be present in the input, but private, reserved, invalid, and scoped addresses are returned as uncharged error rows rather than successful intelligence results.

Does riskScore prove that an IP is malicious?

No. It is a source-provided signal for prioritization and should be combined with your own context and review process.

What happens when one lookup fails?

With continueOnError: true, an individual lookup failure produces a free error row and remaining addresses can continue. A persistent service interruption may stop collection with partial results. With continueOnError: false, processing stops after the first individual error.

Can I receive partial results?

Yes. Available rows remain in the Dataset. Check OUTPUT for resolved, failed, and unprocessed counts before using a collection as complete. If some IPs remain unprocessed, submit those IPs again in a new run.

Responsible use

Use IP intelligence lawfully and proportionately. Follow applicable privacy, data-protection, anti-discrimination, contractual, and security requirements. Do not use approximate geolocation or risk signals as the sole basis for high-impact decisions about a person.

Support

Open the Actor's Issues tab with the run ID, a reproducible non-sensitive IP input, and the expected versus actual result. Avoid posting private internal addresses or confidential logs.