🕵️‍♂️ IP WHOIS & Inspector

A fast, all-in-one tool to perform WHOIS, Reverse DNS, Geolocation, and Port Scanning for a list of IP addresses. It finds the ISP, network owner, hostname, geographic location, and open ports for any public IPv4 or IPv6 address.

---

✨ Features

• Batch Processing: Process a whole list of IP addresses in a single run.
• WHOIS/RDAP: Uses RDAP (Registration Data Access Protocol) for detailed ISP, network, and ASN data.
• Reverse DNS (PTR): Finds the associated hostname for an IP address (e.g., 8.8.8.8 → dns.google).
• Geolocation: Pinpoints the IP’s physical location, including country, city, and timezone.
• Port Scan: Checks a custom list of common ports (e.g., 80, 443, 22) to see if they are open.

---

📥 Input

The Actor's input has been expanded with new options for the added features.

Field	Emoji	Description
IP Addresses to Look Up	🌐	A list of IPv4 or IPv6 addresses to inspect (e.g., 8.8.8.8, 1.1.1.1).
Perform Reverse DNS	🏷️	If checked, finds the hostname (PTR record) for each IP.
Perform Geolocation	🌍	If checked, finds the physical location (country, city) for each IP.
Perform Port Scan	🚦	If checked, scans the ports listed in the “Ports to Scan” input field.
Ports to Scan	🔌	A list of port numbers to check (e.g., 80, 443, 22, 21, 3306). Only used if Port Scan is enabled.

---

📤 Output

The Actor saves its results as one item per IP in the Actor's default dataset.

Example Output

[
  {
    "ip": "8.8.8.8",
    "whois_data": {
      "asn_registry": "arin",
      "asn": "15169",
      "asn_country_code": "US",
      "network": {
        "cidr": "8.8.8.0/24",
        "name": "GOGL",
        "country": "US",
        "entities": ["GOGL"]
      },
      "objects": {
        "GOGL": {
          "handle": "GOGL",
          "name": "Google LLC",
          "contact": {
            "address": [
              {
                "value": "1600 Amphitheatre Parkway\nMountain View\nCA\n94043\nUnited States"
              }
            ],
            "email": [
              { "value": "network-abuse@google.com" }
            ]
          }
        }
      }
    },
    "reverse_dns": {
      "hostname": "dns.google"
    },
    "geolocation": {
      "country": "US",
      "continent": "NA",
      "timezone": "America/Los_Angeles",
      "subdivisions": ["CA"]
    },
    "open_ports": [80, 443]
  }
]

---

💸 Pricing

This Actor uses the Pay-Per-Event (PPE) model with a single, simple pricing event.

You pay per IP address inspected — one dataset result = one charge.

Event	Description	How it works
apify-actor-start	A tiny one-time fee when the Actor run starts.	Charged automatically by the platform. Apify covers the first 5 seconds of compute.
apify-default-dataset-item	Charged once for each IP address result pushed to the dataset.	Charged automatically each time Actor.push_data() is called — no hidden fees.

What's included in each result? Everything you enable — WHOIS, Reverse DNS, Geolocation, and Port Scan data are all bundled into a single dataset item per IP. There are no separate charges per feature.

Spending limit: You can set a maximum cost per run in the Apify Console. The Actor will respect your limit.

---