What it does

Bulk IP Geolocation & Risk Lookup resolves IPv4 and IPv6 addresses in bulk and returns structured geolocation, network and risk intelligence for each successfully processed IP address.

The Actor is designed for log enrichment, suspicious traffic review, user location analysis, VPN/proxy/Tor detection, datacenter IP classification and security, fraud or analytics workflows without maintaining a separate external integration.

Main capabilities

Accepts lists of IPv4 and IPv6 addresses.
Returns country, country code, city, region, ZIP/postal code, latitude, longitude, timezone and local time.
Includes ASN, organization and ISP.
Detects signals such as VPN, proxy, Tor, mobile network and datacenter.
Returns riskScore to prioritize review or automate internal rules.
Can deduplicate IPs before lookup.
Processes large lists in configurable batches.
Retries rate limits, temporary network errors and server errors.
Does not require users to provide an external API key.

Use cases

Enrich access logs, security events or user records.
Detect VPN, proxy, Tor or datacenter traffic.
Review abuse, fraud, spam or suspicious activity.
Build risk rules by country, ASN, ISP or score.
Analyze traffic by location and timezone.
Enrich leads, users or internal datasets with IP intelligence.

Input

The main fields are:

ips: IPv4 or IPv6 addresses to resolve.
batchSize: number of IPs per bulk request.
timeoutSecs: HTTP timeout per request.
maxRetries: retries for rate limits or temporary failures.
deduplicate: removes duplicate IPs before lookup.
continueOnError: keeps the run going if an upstream lookup fails.

Output

Each resolved IP is saved as one dataset item with fields such as:

ip
ok
asn
organization
isp
country
countryCode
city
state
zipcode
latitude
longitude
timezone
localtime
isMobile
isVpn
isTor
isProxy
isDatacenter
riskScore
errorStatus
errorMessage

Pricing

The Actor uses pay-per-event pricing. It charges for each successfully resolved IP through the ip-resolved event. The Actor page lists $0.50 / 1,000 ip resolveds.

Failed upstream lookups are not charged as ip-resolved events.

Infrastructure and recovery

Users do not need to configure external keys. The Actor works in batches, deduplicates inputs when enabled, retries temporary errors and saves structured output to Apify Dataset for export as JSON, CSV, Excel, XML or RSS.

Limits

Only valid IPv4 or IPv6 addresses are accepted.
Results depend on the upstream geolocation and IP intelligence provider.
Risk signals can change over time as reputation, ASN or network ownership changes.
The Actor can stop gracefully if it reaches the configured Apify charge limit.