IP & ASN Intelligence Scraper (Geo, Abuse, RPKI, WHOIS)

Here is one real result, with every field the actor returns:

{
  "resource": "8.8.8.8",
  "resourceType": "ip",
  "asn": "AS15169",
  "asnHolder": "GOOGLE - Google LLC",
  "asnType": "as",
  "prefix": "8.8.8.0/24",
  "country": "US",
  "countryName": "United States",
  "city": null,
  "latitude": 37.751,
  "longitude": -97.822,
  "orgName": "GOGL",
  "isp": "GOOGLE - Google LLC",
  "abuseContacts": [
    "network-abuse@google.com"
  ],
  "reverseDns": "dns.google",
  "rir": "ARIN",
  "allocationStatus": "Direct Allocation",
  "rpkiStatus": "valid",
  "isAnnounced": true,
  "announcedPrefixCount": null,
  "samplePrefixes": null,
  "peersCount": null,
  "isListed": false,
  "listedOn": [],
  "listedCount": 0,
  "aiRiskSummary": "This IP belongs to Google's well-managed AS15169 with valid RPKI and a published abuse contact, so it presents low spam or abuse risk. It is clean across the major DNS blocklists and behaves as trusted infrastructure rather than a residential or bulletproof-hosting range.",
  "observedAt": "2026-08-16T14:24:03.177Z",
  "error": null
}

The most complete IP address lookup and ASN intelligence scraper available: a single API for IP geolocation, ASN ownership, abuse-contact discovery, RPKI and BGP routing checks, reverse DNS, WHOIS, and IP reputation / blocklist (DNSBL) threat checks. For each IP or ASN it aggregates multiple authoritative RIPEstat data calls into one enriched record: geolocation, owning ASN and holder, network prefix (CIDR), abuse contacts, RPKI routing status, reverse DNS, WHOIS-derived RIR and allocation status, and for ASNs the announced-prefix count, a prefix sample, and peer count. Optional paid add-ons layer on a live DNS blocklist reputation check and an AI-written threat/abuse risk assessment.

📥 Input · 📤 Output · 💰 Pricing · ▶️ Examples

Table of contents

• What it does
• Use cases
• Quickstart
• Input reference
• Output reference
• Example output record
• Run via API and CLI
• Fetch results
• Billing and limits
• FAQ and troubleshooting

What it does

Give the actor a list of IP addresses (IPv4 or IPv6) and/or ASNs. For each one it detects the resource type, calls the relevant RIPEstat data endpoints, and writes one normalized intelligence record to the run's dataset.

For an IP it returns the covering network prefix, the owning ASN and its holder, geolocation (country, city, latitude, longitude), the network abuse-reporting contacts, reverse DNS (PTR), the authoritative RIR, the WHOIS allocation status, and the RPKI route-origin validation status for that prefix/origin pair.

For an ASN it returns the holder, whether it is announced, the count of announced prefixes with a capped sample, the abuse contacts, the number of unique BGP peers, and the WHOIS-derived RIR and allocation status.

Every enrichment is resilient: each sub-call is independent, so if one endpoint has no answer for a resource the row is still emitted with the fields that did resolve. Missing values are returned as null, never invented. Data comes entirely from RIPEstat (RIPE NCC), which is open, keyless, and licensed for any use.

Use cases

• Fraud prevention and risk scoring: enrich signup, checkout, or login IPs with geolocation, hosting/proxy signals from ASN type, and blocklist hits to score how risky a visitor is.
• IP reputation and blocklist checks: find out if an IP is listed for spam or abuse on Spamhaus, SpamCop, Barracuda, or SORBS before you trust or whitelist it.
• Threat intelligence enrichment: turn raw firewall, SIEM, or abuse-report IPs into full network context (owner, ASN, country, abuse contact) for faster triage.
• Abuse-contact lookup for takedown reporting: pull the correct network abuse email for any offending IP or ASN to send DMCA, phishing, or spam complaints.
• Bulk IP-to-ASN and IP geolocation lookup: batch-resolve thousands of IPs to their owning ASN, prefix/CIDR, country, and city for analytics or log enrichment.
• BGP and routing hygiene audits: check RPKI route-origin validity, announced-prefix counts, and peer counts for any ASN you depend on or monitor.
• KYB and vendor due diligence: confirm the network a company actually operates on, its RIR allocation status, and whether it looks like clean infrastructure or bulletproof hosting.
• Anti-bot and traffic filtering: identify datacenter, hosting, and proxy networks by ASN type so you can rate-limit or challenge non-residential traffic.

Quickstart

Open the actor, paste this into the input, and press Run. It enriches Google Public DNS, the Google ASN, and Cloudflare DNS.

{
  "resources": ["8.8.8.8", "AS15169", "1.1.1.1"],
  "includeGeolocation": true,
  "includeAbuseContact": true,
  "includeRouting": true,
  "includeReverseDns": true
}

You can mix IPs and ASNs freely. ASNs may be written as AS15169 or 15169. Turn on includeWhois for RIR, allocation status, and organisation name (slower).

Input reference

Field	Type	Required	Default	Description
resources	string[]	no	(empty)	One or more IPs (IPv4 or IPv6) and/or ASNs to enrich. ASNs may be AS15169 or 15169.
resource	string	no	(empty)	Alternative to resources: a single IP or ASN, or several separated by commas, spaces, or new lines.
includeGeolocation	boolean	no	true	Add geolocation (country, city, latitude, longitude) for IP resources.
includeAbuseContact	boolean	no	true	Add the network abuse-reporting email addresses and the authoritative RIR.
includeRouting	boolean	no	true	Add RPKI validation status for IPs, and announced-prefix count/sample plus peer count for ASNs.
includeReverseDns	boolean	no	true	Add the reverse-DNS (PTR) hostname for IP resources.
includeWhois	boolean	no	false	Add WHOIS-derived RIR, allocation status, and organisation name. Slower, off by default.
withThreatCheck	boolean	no	false	Paid add-on. For each IP, check DNS blocklists (Spamhaus, SpamCop, Barracuda, SORBS) and return isListed, listedOn, listedCount. Billed $0.012 per IP, only when the checks complete. Disabled for free users; ASNs skipped.
withAiRisk	boolean	no	false	Paid add-on. Uses AI to produce a 2-3 sentence plain-English threat/abuse risk assessment (aiRiskSummary). Billed $0.012 per resource, only when usable AI output is produced. Disabled for free users.
maxPrefixesPerAsn	integer	no	100	Cap on how many announced prefixes to list in samplePrefixes for an ASN resource.
maxResources	integer	no	(all)	Maximum number of resources to process. Free Apify accounts are capped at 10 per run.
proxyConfiguration	object	no	(none)	Standard Apify proxy configuration. Not required; RIPEstat is not bot protected.

Output reference

One dataset item per input resource. Types: string, number, boolean, string[], or null when the source has no value.

Field	Type	Description
resource	string	The IP address or ASN that was queried.
resourceType	string	ip or asn.
asn	string	Owning (for an IP) or queried ASN, formatted ASxxxx.
asnHolder	string	Name of the organisation holding the ASN.
asnType	string	ASN resource type as reported by RIPEstat.
prefix	string	Network prefix (CIDR) covering the IP, or the first announced prefix for an ASN.
country	string	ISO country code of the IP geolocation.
countryName	string	Human-readable country name.
city	string	City of the IP geolocation, or null if not known.
latitude	number	Latitude of the IP geolocation.
longitude	number	Longitude of the IP geolocation.
orgName	string	Organisation / network owner name (from WHOIS when enabled, else the ASN holder).
isp	string	Internet service provider or network holder name.
abuseContacts	string[]	Abuse-reporting email addresses for the network.
reverseDns	string	Reverse-DNS (PTR) hostname for the IP.
rir	string	Regional Internet Registry: ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC.
allocationStatus	string	Allocation / assignment status from WHOIS (for example Direct Allocation).
rpkiStatus	string	RPKI route-origin validation status: valid, invalid, or unknown.
isAnnounced	boolean	Whether the ASN / prefix is currently announced in BGP.
announcedPrefixCount	number	Number of prefixes announced by the ASN (ASN input only).
samplePrefixes	string[]	Sample of prefixes announced by the ASN, capped by maxPrefixesPerAsn (ASN input only).
peersCount	number	Number of unique BGP peers/neighbours of the ASN (ASN input only).
isListed	boolean	Threat-check add-on: whether the IP is listed on any queried DNS blocklist. null when the add-on is off.
listedOn	string[]	Threat-check add-on: the DNS blocklist zones that flagged the IP.
listedCount	number	Threat-check add-on: number of blocklists that flagged the IP.
aiRiskSummary	string	AI add-on: concise plain-English threat/abuse risk assessment for the resource. null when the add-on is off.
observedAt	string	ISO 8601 timestamp of when the record was collected.
error	string	null on success. Set when a resource is invalid or has no data; that row is not charged.

Example output record

Real record from a live run for the ASN AS15169 (samplePrefixes truncated here for brevity):

{
  "resource": "AS15169",
  "resourceType": "asn",
  "asn": "AS15169",
  "asnHolder": "GOOGLE - Google LLC",
  "asnType": "as",
  "prefix": "57.140.226.0/24",
  "country": null,
  "countryName": null,
  "city": null,
  "latitude": null,
  "longitude": null,
  "orgName": "GOOGLE - Google LLC",
  "isp": "GOOGLE - Google LLC",
  "abuseContacts": ["network-abuse@google.com"],
  "reverseDns": null,
  "rir": "ARIN",
  "allocationStatus": null,
  "rpkiStatus": null,
  "isAnnounced": true,
  "announcedPrefixCount": 1405,
  "samplePrefixes": ["57.140.226.0/24", "172.217.30.0/24", "2404:6800:400a::/48"],
  "peersCount": 335,
  "observedAt": "2026-08-16T14:24:03.177Z",
  "error": null
}

Run via API and CLI

Start a run and read the dataset. Replace <TOKEN> with your Apify API token.

Run synchronously and get dataset items in one call:

curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~ip-asn-intelligence-scraper/run-sync-get-dataset-items?token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"resources":["8.8.8.8","AS15169","1.1.1.1"],"includeWhois":true}'

Start a run asynchronously:

curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~ip-asn-intelligence-scraper/runs?token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"resource":"2001:4860:4860::8888"}'

Apify CLI:

apify call scrapers_lat/ip-asn-intelligence-scraper \
  --input '{"resources":["AS13335"],"includeRouting":true}'

Fetch results

Every run writes to a dataset. Fetch items as JSON, CSV, or Excel by changing format:

# JSON
curl "https://api.apify.com/v2/datasets/<DATASET_ID>/items?token=<TOKEN>&clean=true&format=json"

# CSV
curl "https://api.apify.com/v2/datasets/<DATASET_ID>/items?token=<TOKEN>&clean=true&format=csv"

# Paginate large datasets
curl "https://api.apify.com/v2/datasets/<DATASET_ID>/items?token=<TOKEN>&offset=1000&limit=1000"

<DATASET_ID> is returned as defaultDatasetId in the run object. clean=true drops empty and internal fields.

Billing and limits

• Pay per result. You are charged per enriched record returned (result event). See the pricing tab for the current per-result price.
• Threat check add-on (threat_check, $0.012). Opt-in via withThreatCheck, default off. Runs a live DNS blocklist reputation check for each IP and returns isListed, listedOn, and listedCount. Charged once per IP only when the checks complete (even if the IP is clean). Disabled for free users; ASNs are skipped.
• AI risk add-on (ai_risk, $0.012). Opt-in via withAiRisk, default off. Uses AI to write a plain-English threat/abuse risk assessment (aiRiskSummary). Charged only when usable AI output is produced. Disabled for free users.
• No charge on failure. An invalid resource, or one with no data, is written as a single item with a populated error field and is not charged. Empty runs cost nothing. Add-ons are never charged when they produce no result.
• Spend cap respected. Set maxTotalChargeUsd on the run; once reached, the actor stops emitting and charging further billable results.
• Free Apify plans are capped at 10 resources per run. Upgrade for higher maxResources.
• Fair use. The actor paces its RIPEstat calls (about 8 per second) and retries on rate limits, so large batches take longer rather than failing.

FAQ and troubleshooting

What is the data source? All data comes from RIPEstat, the open data platform run by the RIPE NCC. It is keyless, free, and licensed for any use. This actor only reads publicly available data.

Can I pass both IPs and ASNs in one run? Yes. Mix them freely in resources. The actor detects each resource type automatically. An ASN can be written as AS15169 or 15169.

Why are country, latitude, and longitude null for an ASN? Geolocation is a property of an IP address, not an ASN. For ASN inputs those fields stay null, and you get routing fields (announcedPrefixCount, samplePrefixes, peersCount) instead.

Why is rpkiStatus null for some IPs? RPKI validation needs both an origin ASN and a covering prefix. If the IP has no announced prefix or origin ASN in RIPEstat, the status cannot be computed and stays null.

How accurate is the geolocation? It uses the MaxMind GeoLite database exposed through RIPEstat. It is a good country-level and often city-level signal, but IP geolocation is approximate and should not be treated as a precise physical location.

How many announced prefixes do I get for an ASN? announcedPrefixCount is the true total. samplePrefixes lists up to maxPrefixesPerAsn (default 100) of them so large ASNs do not bloat every record.

Is this an official RIPE tool? No. This actor is independent and not affiliated with the RIPE NCC. It reads only data that RIPEstat makes publicly available, in accordance with the RIPEstat terms of service.

Related scrapers

• DNS & Domain Intelligence Scraper: full DNS records plus SPF, DMARC, DKIM, and DNSSEC for any domain.
• Certificate Transparency Scraper: TLS certificates and subdomains from CT logs.

More scrapers at scrapers.lat

Built and maintained by scrapers.lat, where we publish scrapers for US and Latin American public platforms: company registries, government data, finance, e-commerce, and more. Browse the catalog or request a custom scraper at scrapers.lat.

---

Independent tool, not affiliated with the RIPE NCC. Accesses only publicly available RIPEstat data. Use in accordance with the RIPEstat terms of service.