Skip to content

IP, ASN & Subdomain Lookup

Try for free

Bulk IP lookup: country, city, time zone, ASN and ISP, BGP prefix, reverse DNS, cloud/hosting and Tor flags, registry abuse contacts and a risk score for every IPv4/IPv6 address or hostname. Plus every subdomain of a domain from certificate-transparency logs, resolved to its IP, country and network. No login or API key needed.

🌐 IP, ASN & Subdomain Lookup

Look up thousands of IP addresses in one run: country, city, time zone, ASN and ISP, BGP prefix, reverse DNS, cloud and hosting detection, Tor exits, the registry's abuse contact and a transparent risk score for every IPv4/IPv6 address or hostname. Add a domain and you also get every subdomain that ever appeared on a public TLS certificate, resolved to its IP, country and network. No login or API key needed; $2.50 per 1,000 IP lookups and $0.65 per 1,000 subdomains.

✨ Why use IP, ASN & Subdomain Lookup?

  • ⚡ Fast in bulk: geolocation and ASN come from a built-in database, so 1,000 addresses with reverse DNS, BGP prefix and hosting checks take well under a minute.
  • 🧭 Everything about an address in one row: location, network, ISP, PTR name with forward confirmation, cloud provider with service and region, Tor exit status and abuse e-mail.
  • 🔎 Subdomains from certificate logs: the full history of names a domain put on certificates, with first and last seen dates, issuers and whether each name still resolves.
  • 📋 Paste anything: IPs, hostnames, URLs, host:port, or raw log text; every address is found and deduplicated.
  • 🛡️ Clear risk triage: an additive score with the reasons spelled out, country geo-fencing and an "only flagged" filter.
  • 💸 Pay for rows only: invalid entries, filtered rows and names that do not resolve (with the filter on) cost nothing.

🎯 Use cases

  • 🚨 Sign-up and payment fraud triage: flag sign-ups from datacenters, Tor or countries you do not serve.
  • 🧾 Security log enrichment: paste nginx, firewall or mail logs and get the network, owner and abuse contact of every address.
  • 🤖 Crawler verification: reverse DNS plus forward confirmation shows whether a "Googlebot" request really comes from Google.
  • 🏗️ Attack-surface and asset inventory: list a company's subdomains, see which still resolve and on which cloud or CDN they run.
  • 🏢 Infrastructure due diligence: resolve hostnames and map them to providers, regions and networks.
  • 📈 Analytics and lead enrichment: turn visitor IPs into country, city, time zone and company network.

🚀 How to use

  1. Paste IP addresses or hostnames into IP addresses or hostnames, or raw text into Text with IP addresses.
  2. Add domains under Domains (list subdomains) if you want their subdomains.
  3. Pick the data you need (reverse DNS, BGP prefix, hosting, Tor, registry record) and, if you like, allowed countries and filters.
  4. Click Start and download the results as JSON, CSV, Excel or HTML, or read them through the API.

📥 Input

FieldWhat it does
ipsIPv4/IPv6 addresses or hostnames (hostnames resolve to one row per address). URLs and host:port work too.
domainsDomains to list subdomains for, from certificate-transparency logs.
textFree text (logs, CSV, e-mail headers); every valid address in it is looked up.
maxItemsStop after this many IP rows (empty = all).
includeAsnBGP prefix, registry, allocation date and full AS name (default on).
includeReverseDnsPTR names and forward confirmation (default on).
includeHostingCheckCloud/hosting detection (default on).
includeTorCheckTor exit check (default on).
includeRdapRegistry network record and abuse e-mail (default off).
maxSubdomainsPerDomainStop after this many subdomains per domain (empty = all).
includeExpiredInclude names that only appear on expired certificates (default on).
resolveSubdomainsAdd each subdomain's addresses, country and network (default on).
onlyResolvingKeep only subdomains that resolve now.
allowedCountries, onlyFlagged, minRiskScore, skipBogonsRisk and filters.
fieldsKeep only these output columns, in this order.
{
  "ips": ["8.8.8.8", "185.220.101.1", "2606:4700:4700::1111", "scrape.ly"],
  "domains": ["python.org"],
  "includeRdap": true,
  "allowedCountries": ["US"]
}

📤 Output

One row per IP address (type: "ip") and one row per subdomain (type: "subdomain"). The dataset has four views: IP overview, Risk triage, Network & abuse contacts and Subdomains.

IP row (from a test run with includeRdap on and allowedCountries: ["US"], trimmed):

{
  "type": "ip",
  "input": "8.8.8.8",
  "ip": "8.8.8.8",
  "ipVersion": 4,
  "isBogon": false,
  "found": true,
  "continent": "North America",
  "country": "United States",
  "countryCode": "US",
  "region": "California",
  "city": "Mountain View",
  "lat": 37.422,
  "lon": -122.085,
  "timezone": "America/Los_Angeles",
  "utcOffset": "-08:00",
  "callingCode": "1",
  "asn": 15169,
  "asName": "GOOGLE - Google LLC, US",
  "isp": "Google LLC",
  "bgpPrefix": "8.8.8.0/24",
  "rir": "ARIN",
  "prefixAllocatedAt": "2023-12-28",
  "hostname": "dns.google",
  "reverseDns": ["dns.google"],
  "forwardConfirmed": true,
  "isHosting": true,
  "hostingSource": "asn-list",
  "cloudProvider": "Google",
  "isTorExit": false,
  "networkName": "GOGL",
  "networkCidr": "8.8.8.0/24",
  "org": "Google LLC",
  "abuseEmail": "network-abuse@google.com",
  "outsideAllowedCountries": false,
  "riskScore": 35,
  "riskLevel": "medium",
  "riskReasons": ["datacenter / cloud network"],
  "sources": ["dbip-lite", "team-cymru", "reverse-dns", "rdap", "cloud-ip-ranges", "tor-exit-list"],
  "note": null,
  "checkedAt": "2026-11-12T23:46:09Z"
}

Subdomain row (trimmed):

{
  "type": "subdomain",
  "input": "python.org",
  "domain": "python.org",
  "subdomain": "bugs.python.org",
  "isWildcard": false,
  "certCount": 90,
  "firstSeen": "2013-12-24T20:39:02Z",
  "lastSeen": "2026-08-20T23:02:22Z",
  "certExpiresAt": "2026-11-18T23:02:21Z",
  "hasValidCert": true,
  "issuers": ["Let's Encrypt", "DigiCert Inc", "Gandi"],
  "resolves": true,
  "ips": ["45.55.99.191"],
  "ip": "45.55.99.191",
  "countryCode": "US",
  "asn": 14061,
  "asName": "DigitalOcean, LLC",
  "isHosting": true,
  "cloudProvider": "DigitalOcean",
  "source": "crt.sh"
}
FieldDescription
ip, ipVersion, inputThe address, 4 or 6, and the input entry it answers (the hostname for resolved rows).
isBogon, bogonTypeReserved address and its type (private, loopback, carrier-grade-nat, documentation...). Reserved addresses are never sent to an outside service.
continent, country, countryCode, region, city, lat, lon, timezone, utcOffset, isEu, flag, callingCodeLocation of the address.
asn, asName, asCountry, isp, orgAutonomous system, the organization that runs the network, and the owner of the address block (registry record with includeRdap, else the network operator).
bgpPrefix, rir, prefixAllocatedAtAnnounced prefix, regional registry and allocation date.
hostname, reverseDns, forwardConfirmedPTR names and whether the name points back to the address.
isHosting, hostingSource, cloudProvider, cloudService, cloudRegionDatacenter detection (cloud-ranges = official provider range, asn-list = known hosting network, asn-name = hosting words in the network name, a weaker signal).
isTorExitAddress is on the Tor Project's exit list.
networkName, networkHandle, networkRange, networkCidr, networkType, networkCountry, networkRegisteredAt, abuseEmail, rdapUrlRegistry record (with includeRdap).
outsideAllowedCountries, riskScore, riskLevel, riskReasonsRisk triage.
subdomain, domain, isWildcard, certCount, firstSeen, lastSeen, certExpiresAt, hasValidCert, issuers, sourceSubdomain rows: certificate history of the name.
resolves, ipsSubdomain rows: current addresses (with resolveSubdomains).
sources, note, checkedAtWhich data sources answered, why a part is empty, and when.

Risk score (additive, capped at 100): Tor exit +60, reserved address +50, hosting from an official range or known hosting network +35, hosting from the network name +20, country outside allowedCountries +25, no reverse DNS +5. riskLevel: none (0), low (1 to 29), medium (30 to 59), high (60+). It is a triage signal, not a fraud verdict.

A run summary (inputs skipped and why, hostnames without addresses, data sources used) is saved as SUMMARY in the run's key-value store.

💰 Pricing

  • IP lookup: $2.50 per 1,000 IP rows on the Free plan ($0.0025 each), $2.40 on Starter, $2.25 on Scale and Business.
  • Subdomain: $0.65 per 1,000 subdomain rows on every plan.
  • Platform usage is included: there is no start fee and no compute or proxy charge on top.

Examples: 100 sign-up IPs ≈ $0.25; 1,000 log IPs ≈ $2.50; a domain with 120 subdomains ≈ $0.08. Invalid inputs, rows removed by your filters and hostnames that do not resolve are not charged. Your maximum cost per run is respected: the run stops at the row that would go over it and says so.

❓ FAQ

Is it legal? The actor reads public network data: routing tables, reverse DNS, registry records, published cloud ranges and public certificate-transparency logs. How you use the results is up to you and the laws that apply to you.

Do I need a login, API key or proxy? No. Lookups run through Scrape.ly datacenter proxies by default.

How many addresses can I look up? As many as you like; there is no cap. Rows are saved in batches as they are looked up, so long lists stream into the dataset. In our tests with every default option on, 1,000 random addresses took under a minute and 10,000 took about 11 minutes. For very long lists, raise the run timeout or turn off what you do not need (reverse DNS is the slowest part).

Why is a field empty? Not every address has every attribute: many have no reverse DNS, unrouted addresses have no ASN, and city-level location is not known for every network. When a source did not answer, note says which.

How accurate is the location? IP geolocation is approximate, best at country level and weakest for mobile and carrier-grade NAT networks. Data: IP geolocation by DB-IP (db-ip.com), licensed CC BY 4.0, refreshed with each actor build.

Where do subdomains come from? From certificate-transparency logs (crt.sh). If that search does not answer, the run falls back to certspotter, which lists names on currently valid certificates only; the row's source and the run log say so.

Can I schedule it or use the API? Yes. Schedule runs in the console, or start them through the Scrape.ly API and read the dataset as JSON, CSV or Excel.

⚠️ Limits

  • Commercial VPN and residential-proxy detection is not included; isHosting covers datacenter, cloud and CDN networks, and isTorExit covers Tor.
  • CIDR ranges are not expanded; list the addresses you want.
  • Subdomains are names that appeared on public TLS certificates. Internal names that never got a certificate are not listed, and wildcard certificates show as *.name.
  • Very large domains (hundreds of thousands of certificates) can be too big for the certificate log search; the fallback then returns names on current certificates only.
  • The registry record (includeRdap) is asked once per network at a gentle pace, so long lists of unrelated addresses take longer with it on.

Related actors

//From the blog\\

Latest articles

All articles
G2
4.7/5
Excellent
Trustpilot

The internet is full of data.
Start owning yours.

Scrape.ly gives you the infrastructure, the tooling, and the team to extract, process, and operationalize web data at any scale. Setup takes minutes.

Get Started FreeChat with Support
No credit card. No setup calls.