The Scenario
You inherited the security incident log from the engineer who quit last month. There's an Excel workbook with 800 unique IPs pulled from the access logs of three internal tools, and leadership wants to know before Thursday's all-hands how many of those requests came from outside the US, and how many of those were coming through known proxy or VPN endpoints. Nobody left documentation. The workbook has column headers but the IP column is labeled "src_ip" and there are three other columns with notes in them that may or may not be accurate.
The bad version:
- Manually look up a sample of IPs to get a feel for the data, then try to figure out whether the "is_internal" column someone added months ago means what you think it means
- Write a Python script to hit the IP2Location.io API row by row, then realize your API key has a rate limit you weren't expecting and the script stops at row 248
- Paste the partial results into the workbook, flag the gap manually, and send a draft report to your manager with a note that "the data is incomplete pending a script fix"
Thursday is two days away. The report needs to be complete, not a draft with a footnote.
The Easy Way: One Prompt in SheetXAI
SheetXAI is an AI agent that lives inside your Excel workbook. It reads the data — including your "src_ip" column by name — and uses its IP2Location.io integration to enrich and classify every row, handling the batching and response parsing for you.
Send all IP addresses in column A to IP2Location.io bulk geolocation in batches of up to 1,000 and write the country code, city, and is_proxy flag to columns B, C, and D.
What You Get
- Column B: ISO country code per IP (e.g., "US", "DE", "CN")
- Column C: city name
- Column D: proxy/VPN flag — "true" or "false"
- All 800 rows processed in a single run, no rate-limit interruptions surfaced to you
- Any malformed IPs flagged in the chat, not silently skipped
What If the Data Is Not Quite Ready
You need a classification column on top of the raw geolocation data
In column E, write 'DOMESTIC' if country code in column B is 'US', 'PROXY/VPN' if the is_proxy flag in column D is true, and 'INTERNATIONAL' otherwise. Then count each category and write the totals to cells G1, G2, and G3.
Some IPs appear multiple times — you only want unique lookups
Deduplicate the IP addresses in column A before sending to IP2Location.io, enrich only the unique IPs, then write the country code and proxy flag back to every matching row in the original workbook.
The access log spans multiple worksheets — 'App1 Logs', 'App2 Logs', 'App3 Logs'
Collect all IP addresses from column A on the 'App1 Logs', 'App2 Logs', and 'App3 Logs' worksheets, deduplicate, send to IP2Location.io, and write enriched results to a new worksheet called 'Unified IP Report' with source app in column A, IP in column B, country code in column C, city in column D, and proxy flag in column E.
Full classification, dedup, summary, and high-risk flag in one instruction
Deduplicate the IPs in column A, enrich all unique IPs via IP2Location.io writing country code to column B, city to column C, and proxy flag to column D. In column E write 'DOMESTIC' if B is 'US', 'PROXY/VPN' if D is true, and 'INTERNATIONAL' otherwise. In column F write 'HIGH RISK' if D is true or B is in ['CN','RU','KP','IR']. Count each classification and write totals to G1 through G3.
Asking for the dedup, enrichment, classification, and risk flag in one prompt is faster than sequencing them as four separate steps — and the result lands in a single pass.
Try It
If you have an access-log workbook or security audit with a column of IPs, Get the 7-day free trial of SheetXAI and ask it to classify them by origin using IP2Location.io. For bulk geolocation of sign-up IPs, see the bulk geolocate guide or the full hub overview.