🕵️‍♂️ IP WHOIS & Inspector

A fast, all-in-one tool to perform WHOIS, Reverse DNS, Geolocation, and Port Scanning for a list of IP addresses. It finds the ISP, network owner, hostname, geographic location, and open ports for any public IPv4 or IPv6 address.

---

✨ Features

• Parallel Processing: Blazing fast batch lookups using concurrent task execution.
• Cloud Detection: Automatically identifies if an IP belongs to AWS, Azure, GCP, Cloudflare, etc.
• Smart Caching: Reuses results from the Key-Value store to save time and API limits.
• WHOIS/RDAP: Uses RDAP for detailed ISP, network, and ASN data.
• Reverse DNS (PTR): Finds the associated hostname for an IP address.
• Geolocation: Pinpoints physical location (requires MaxMind license).
• Port Scan: Checks if common ports (80, 443, 22, etc.) are open.

---

📥 Input

The Actor's input has been expanded with new options for the added features.

Field	Emoji	Description
IP Addresses to Look Up	🌐	A list of IPv4 or IPv6 addresses to inspect (e.g., 8.8.8.8, 1.1.1.1).
Max Concurrency	⚡	How many IPs to process in parallel (default: 10).
Use Cache	🧠	Reuses results for IPs processed in the last X days.
Ports to Scan	🔌	A list of port numbers to check (e.g., 80, 443, 22, 21, 3306).

---

📤 Output

The Actor saves its results as one item per IP in the Actor's default dataset.

Example Output

[
  {
    "ip": "8.8.8.8",
    "whois_data": {
      "asn_registry": "arin",
      "asn": "15169",
      "asn_country_code": "US",
      "network": {
        "cidr": "8.8.8.0/24",
        "name": "GOGL",
        "country": "US",
        "entities": ["GOGL"]
      },
      "objects": {
        "GOGL": {
          "handle": "GOGL",
          "name": "Google LLC",
          "contact": {
            "address": [
              {
                "value": "1600 Amphitheatre Parkway\nMountain View\nCA\n94043\nUnited States"
              }
            ],
            "email": [
              { "value": "network-abuse@google.com" }
            ]
          }
        }
      }
    },
    "reverse_dns": {
      "hostname": "dns.google"
    },
    "geolocation": {
      "country": "US",
      "continent": "NA",
      "timezone": "America/Los_Angeles",
      "subdivisions": ["CA"]
    },
    "open_ports": [80, 443]
  }
]

---

💸 Pricing

This Actor uses the Pay-Per-Event (PPE) model. Starting March 19, 2026, you pay a single flat fee per IP address inspected. One dataset result = everything included (WHOIS, DNS, Geo, Cloud Detection, Port Scan).

Event	Event ID	No Discount	Bronze	Silver	Gold
Actor Start	apify-actor-start	$0.00005	$0.00005	$0.00005	$0.00005
IP Processed	apify-default-dataset-item	$0.003	$0.0027	$0.0023	$0.002

Why this is a great deal:

• All-in-one: You get WHOIS, Reverse DNS, Geolocation, Cloud Provider Detection, and Port Scanning for a single price.
• Smart Caching: If an IP was processed recently, the Actor uses the cache—you still get the data, but the run finishes in milliseconds.
• Volume Discounts: Prices automatically drop as you move up Apify tiers (Bronze/Silver/Gold).

Spending limit: You can set a maximum cost per run in the Apify Console. The Actor will respect your limit and stop before exceeding it.

---