Run an IP Threat Scan From an Excel workbook Using BigDataCloud

The Scenario

Your fraud team flagged 250 checkout orders as suspicious — high order values, new accounts, billing and shipping addresses in different countries. The IP address for each checkout is already in your Excel workbook, column A, alongside order IDs and amounts.

Before anyone escalates these to the fraud review queue, the team wants each IP tagged: is it a VPN exit node? A known proxy? A TOR relay? How many blacklists is it on?

Right now that information doesn't exist in the workbook. Without it, the fraud analyst has to open BigDataCloud's web interface, look up IPs one at a time, and copy the risk flags into the workbook by hand.

The bad version:

• Open BigDataCloud's hazard report endpoint documentation, run a curl command for the first IP, decode the response fields.
• Realize there are 250 rows and the manual lookup is going to take the rest of the afternoon.
• Export the list, hand it to the developer on the team, ask them to write a batch script — now the fraud team is blocked until the script is ready and tested.

The escalation meeting is at 4 PM and the list is still untagged.

The Easy Way: One Prompt in SheetXAI

SheetXAI is an AI agent that lives inside your Excel workbook. It reads your data, calls BigDataCloud's hazard report API across your IP column, and writes the risk flags back into adjacent columns — no script required.

Open SheetXAI from the Excel add-in panel and type:

Check all IPs in my Suspicious Orders sheet for proxy or TOR usage and highlight rows in red where any hazard flag is true

What You Get

• Columns B through E: is_vpn, is_proxy, is_tor, and blacklist_count written per row
• Rows where any hazard flag is true are highlighted red across the full row
• Rows where BigDataCloud returns no result get blank cells; SheetXAI notes the count of unresolved IPs after the run

What If the Data Is Not Quite Ready

The IP column includes duplicates — same IP appears across multiple orders

Run a BigDataCloud hazard report on every IP in column A — deduplicate before calling the API (look up each unique IP once), then write is_vpn, is_proxy, is_tor, and blacklist_count back to every row that shares that IP

Some rows are missing the IP — only order ID and amount are present

Run BigDataCloud hazard reports on column A — skip rows where column A is blank, mark those rows "no IP" in column B, and process the rest with is_vpn, is_proxy, is_tor, and blacklist_count in columns B through E

You need the results as a sortable table, not just highlighted rows

Check every IP in column A against BigDataCloud's hazard report, write is_vpn, is_proxy, is_tor, and blacklist_count into columns B through E, highlight flagged rows red, then convert the range to an Excel table so the fraud team can sort by blacklist_count descending

Full risk triage in one pass

For every IP in column A, run a BigDataCloud hazard report — write is_vpn, is_proxy, is_tor, and blacklist_count into columns B through E, highlight flagged rows red, then create a new worksheet called "Escalate" with only the rows where at least one hazard flag is true, sorted by blacklist_count descending

One prompt handles the enrichment, the conditional formatting, and the escalation worksheet.

Try It

Get the 7-day free trial of SheetXAI and open any Excel workbook with a column of IP addresses from suspicious transactions — paste the prompt above and have your fraud flags ready before the next review meeting. See the geolocation spoke if you also need country and region data for the same IP set.