Bulk IP Geolocation & Risk Lookup

Resolve public IPv4 and IPv6 addresses into structured geolocation, network, timezone, and risk data. Submit a list of IPs and receive export-ready Dataset rows with clear uncharged error reporting when an address cannot be resolved.

What this Actor does

Bulk IP Geolocation & Risk Lookup returns country, city, coordinates, ASN, organization, ISP, timezone, and indicators for mobile, VPN, Tor, proxy, and datacenter networks. It validates public IPs, can remove duplicates before lookup, and isolates individual failures so a bad address does not have to stop the whole batch.

Use cases

• Enrich security, access, fraud-review, or infrastructure logs with IP context.
• Segment traffic by country, region, city, ISP, or autonomous system.
• Flag VPN, proxy, Tor, mobile, or datacenter addresses for further review.
• Add geographic and network fields to analytics or lead datasets.

How to use

1. Open the Actor in Apify Console.
2. Add public IPv4 or IPv6 addresses and keep deduplication enabled unless repeated rows are required.
3. Click Start and open the Dataset when the run finishes.

Input

ips is required and accepts 1 to 100,000 IPv4 or IPv6 strings. deduplicate defaults to true and removes repeated addresses before requests. continueOnError defaults to true, which writes failed inputs as uncharged error rows and continues processing the rest. Private, reserved, invalid, and scoped addresses do not produce successful intelligence results. Inputs are normalized before lookup; duplicate normalization can reduce the number of requests and output rows.

{
  "ips": [
    "1.1.1.1"
  ],
  "deduplicate": true,
  "continueOnError": true
}

Output

Each Dataset item contains the submitted IP, success status, available network and location details, risk indicators, and nullable error fields. This is the complete Dataset item from a real successful run:

{
  "ip": "1.1.1.1",
  "ok": true,
  "asn": "AS13335",
  "organization": "Cloudflare, Inc.",
  "isp": "Cloudflare, Inc.",
  "country": "Australia",
  "countryCode": "AU",
  "city": "Sydney",
  "state": "New South Wales",
  "zipcode": "1001",
  "latitude": -33.871407346343524,
  "longitude": 151.22338452334142,
  "timezone": "Australia/Sydney",
  "localtime": "2026-09-09T08:29:11",
  "isMobile": false,
  "isVpn": false,
  "isTor": false,
  "isProxy": false,
  "isDatacenter": true,
  "riskScore": 0,
  "errorCode": null,
  "errorStatus": null,
  "errorMessage": null
}

For failed inputs, ok is false, available intelligence fields are null, and the error fields explain the failure. Results can be exported as JSON, CSV, Excel, XML, or JSONL.

Pricing

Each successfully resolved public IP triggers one ip-resolved event. Your Apify subscription tier determines its price:

Apify user tier	Price per resolved IP	Equivalent per 1,000 resolved IPs
Free	$0.0005	$0.50
Bronze	$0.00045	$0.45
Silver	$0.0004	$0.40
Gold	$0.000375	$0.375
Platinum	$0.000375	$0.375
Diamond	$0.000375	$0.375

The 1,000-IP amounts are comparison equivalents; Apify charges each successful IP individually. Invalid, private, reserved, scoped, or failed addresses returned as error rows do not create this event. The current Pricing tab on the Actor page is authoritative.

Related Actors

Actor	Best for
Website Technology Lookup – CMS, Hosting & Tech Stack Data	Enriching associated domains with CMS, hosting, and technology categories.
Bulk Domain Rating Checker	Adding backlink-profile strength to domains connected with the resolved IPs.
Similarweb Website Traffic & SEO Analytics Scraper	Adding traffic, ranking, geography, and competitor estimates for associated sites.

Limits and data quality

The Actor accepts at most 100,000 submitted IP values per run. Geolocation and risk attributes are intelligence estimates, not proof of a person's physical location or behavior. Mobile networks, VPNs, carrier-grade NAT, cloud infrastructure, and reassigned address blocks can reduce precision. Fields can be null when the source has no value. Risk indicators and scores can change over time, and city-level coordinates should not be treated as an exact device location. Deduplication changes the number of output rows when repeated inputs are submitted. Temporary provider failures are retried; a run can stop at the configured maximum charge and resume from its durable checkpoint without intentionally recharging completed batches.

Frequently asked questions

Can I submit private IP addresses?

They can be present in the input, but private, reserved, invalid, and scoped addresses are returned as uncharged error rows rather than successful intelligence results.

Does riskScore prove that an IP is malicious?

No. It is a source-provided signal for prioritization and should be combined with your own context and review process.

What happens when one lookup fails?

With continueOnError: true, the Actor records an error row and proceeds with remaining addresses. Disable it only when the run must stop at the first failure.

Can a run resume after a charge or process failure?

Yes. The Actor checkpoints progress and keeps a durable idempotency record for tiered billing. A retry reuses the same charge key and does not intentionally write a second successful row for a completed batch.

Responsible use

Use IP intelligence lawfully and proportionately. Follow applicable privacy, data-protection, anti-discrimination, contractual, and security requirements. Do not use approximate geolocation or risk signals as the sole basis for high-impact decisions about a person.

Support

Open the Actor's Issues tab with the run ID, a reproducible non-sensitive IP input, and the expected versus actual result. Avoid posting private internal addresses or confidential logs.