Bulk IP Geolocation & Network Intelligence — Country, ASN, Proxy/VPN Detection

Look up thousands of IP addresses at once. Paste a list and get, for each IP: country, region, city, coordinates, timezone, ISP, organization and ASN — plus proxy/VPN, hosting/datacenter and mobile flags.

Fast, keyless and built for scale — the IP intelligence you need for fraud detection, security, analytics and lead enrichment.

---

Why this Actor?

An IP address is a rich signal — where a visitor is, what network they're on, and whether they're hiding behind a proxy, VPN or datacenter. But looking IPs up one by one is slow. This Actor resolves them in bulk, hundreds per request, and returns a clean, analysis‑ready table:

• Geolocation — country, region, city, ZIP, latitude/longitude and timezone.
• Network — ISP, organization, ASN and AS name.
• Risk flags — is the IP a proxy/VPN/Tor exit, a hosting/datacenter IP, or a mobile connection?

That combination is exactly what you need to score traffic, catch fraud and enrich records — at the scale of a whole log file or user table.

---

What you can do with it

• Fraud & abuse detection — flag sign‑ups, orders and clicks coming from proxies, VPNs, Tor or datacenters.
• Security & threat intel — enrich firewall/SIEM logs with geo + ASN + risk flags for triage.
• Analytics & geo‑reporting — turn a list of visitor IPs into country/city/ISP breakdowns.
• Lead & CRM enrichment — add company (ISP/org), country and timezone to records by IP.
• Ad‑tech & traffic quality — separate real users from datacenter/proxy traffic.
• Compliance & geo‑rules — apply country‑ and network‑based policies.

---

What you get — output fields

One record per IP:

Field	Description
ip	The IP address
status	success or fail
continent / country / countryCode	Location
regionCode / regionName / city / district / zip	Region and city detail
lat / lon	Coordinates
timezone / utcOffset	IANA timezone and UTC offset
currency	Local currency
isp	Internet service provider
org	Organization
asn	Autonomous system number (e.g. AS15169)
asName	AS name (e.g. GOOGLE)
reverse	Reverse DNS hostname (when enabled)
isMobile	true for mobile/cellular networks
isProxy	true for proxy, VPN or Tor exit nodes
isHosting	true for hosting/datacenter IPs
message	Failure reason, if any
scrapedAt	ISO timestamp

---

Example output

{
  "ip": "8.8.8.8",
  "status": "success",
  "country": "United States",
  "countryCode": "US",
  "regionName": "Virginia",
  "city": "Ashburn",
  "lat": "39.03",
  "lon": "-77.5",
  "timezone": "America/New_York",
  "isp": "Google LLC",
  "org": "Google Public DNS",
  "asn": "AS15169",
  "asName": "GOOGLE",
  "isMobile": "false",
  "isProxy": "false",
  "isHosting": "true",
  "scrapedAt": "2026-07-10T13:00:00.000Z"
}

{
  "ip": "185.220.101.1",
  "status": "success",
  "country": "Germany",
  "city": "Brandenburg an der Havel",
  "isp": "Stiftung Erneuerbare Freiheit",
  "asn": "AS60729",
  "asName": "TORSERVERS-NET",
  "isProxy": "true",
  "isHosting": "false",
  "isMobile": "false"
}

---

Input

Field	Type	Default	Description
ipAddresses	array	—	Required. IPv4/IPv6 addresses to look up.
language	string	en	Language for country/region/city names.
includeReverse	boolean	false	Also resolve reverse DNS (slower).
proxyConfiguration	object	off	Apify Proxy — rotate IPs for higher throughput on huge lists.

Basic lookup

{
  "ipAddresses": ["8.8.8.8", "1.1.1.1", "213.108.105.1"]
}

With reverse DNS

{
  "ipAddresses": ["8.8.8.8", "208.67.222.222"],
  "includeReverse": true
}

IPv6 is fully supported, and URLs/hosts with an embedded IP are accepted too (the IP is extracted).

---

Use cases in detail

1. Fraud & abuse detection

Filter isProxy = true or isHosting = true to spot traffic hiding behind VPNs, proxies, Tor or datacenters — a strong signal for fake sign‑ups, bonus abuse and payment fraud.

2. Enrich security logs

Feed the IPs from your firewall, WAF or SIEM and get country + ASN + risk flags per IP, so your team can triage alerts by geography and network.

3. Analytics and geo‑reporting

Turn a raw list of visitor IPs into a country/city/ISP breakdown for dashboards and reports — no client‑side geo needed.

4. Lead and CRM enrichment

Add the ISP/organization, country and timezone behind an IP to your records — useful for B2B enrichment and routing.

5. Traffic‑quality scoring

Separate genuine mobile/residential users from datacenter and proxy traffic to measure and improve traffic quality.

---

How to use it

1. Click Try for free.
2. Paste your IP addresses.
3. (Optional) Pick a language or enable reverse DNS.
4. Click Start.
5. Export as JSON, CSV, Excel or HTML table, or via the Apify API.

Lookups run in batches of 100, so large lists are processed efficiently.

---

Calling from the API

curl -X POST "https://api.apify.com/v2/acts/YOUR_ACTOR_ID/runs?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "ipAddresses": ["8.8.8.8", "1.1.1.1"] }'

Fetch the results (JSON or CSV):

$curl "https://api.apify.com/v2/acts/YOUR_ACTOR_ID/runs/last/dataset/items?token=YOUR_APIFY_TOKEN&format=csv"

---

Tips for the best results

• Filter isProxy / isHosting to build a quick risk list from any set of IPs.
• Group by countryCode, asn or isp for reporting.
• Leave includeReverse off for the fastest runs; enable it only when you need PTR hostnames.
• Enable proxy for very large lists so lookups rotate across IPs and run faster.
• Use timezone to localise send times or display.

---

Frequently asked questions

Does it support IPv6? Yes — both IPv4 and IPv6.

What do the proxy/hosting/mobile flags mean? isProxy marks proxies, VPNs and Tor exit nodes; isHosting marks hosting/datacenter IPs; isMobile marks mobile/cellular networks. Together they're a strong traffic‑quality and fraud signal.

How accurate is the location? IP geolocation is accurate to country level almost always, and typically to region/city in populated areas. It reflects the network's registration, not a device's GPS.

How many IPs can it handle? From a handful to millions, processed in batches of 100. Enable proxy for the largest lists.

Why is an IP marked fail? The value wasn't a valid public IP (e.g. a private/reserved range or a typo). The message explains why.

Do I need an API key? No. Just paste your IPs and run.

In which format can I export? JSON, CSV, Excel, HTML table, or via the Apify API.

---

Notes

This Actor returns network‑level information associated with public IP addresses. Use it in line with applicable privacy laws and only on IPs you have a legitimate reason to check. IP geolocation is approximate and network flags are heuristic signals, not guarantees.

---

Support

Need extra fields (e.g. abuse contacts, threat feeds) or higher throughput? Open an issue from the Actor's page and describe what you need.