The Scenario
Third time this week someone has flagged a new batch of suspicious IPs in the brand protection channel. The pattern is always the same: a cluster of phishing pages or fake storefronts surfaces, someone captures the IPs, and your job is to figure out how wide the network actually is. The question isn't just "what's on this IP" — it's "what else is on this IP that we haven't seen yet."
You've got 30 IPs in an Excel workbook. You need to know every domain co-hosted on each one.
The bad version:
- Open a reverse IP lookup tool, paste the first IP, get a list of co-hosted domains, copy them into column B as a comma-separated block
- Realize the tool paginates results and you're only seeing the first 20 domains — you'll need to click through to get the rest
- Do this 29 more times, then try to figure out how to unroll the comma-separated lists into individual rows so you can actually work with the data
The fraud network isn't going to stay static while you work through 30 manual lookups.
The Easy Way: One Prompt in SheetXAI
SheetXAI is an AI agent that lives inside your Excel workbook. It reads the IP list and uses IP2Location.io's hosted-domain API to retrieve the co-hosted domains for each one, writing results back in whatever format is most useful for your next step.
For each IP in column A, use IP2Location.io to retrieve the list of hosted domains and write them as a comma-separated list to column B.
What You Get
- Column B: comma-separated list of all domains co-hosted on that IP, one cell per source IP
- IPs that return zero hosted domains get a "none" or empty value in column B, noted in the chat
- No pagination gaps — SheetXAI retrieves the full result set, not just the first page
What If the Data Is Not Quite Ready
You need each co-hosted domain on its own row, not bundled in a single cell
Look up all hosted domains for the IPs in column A using IP2Location.io and write each domain on its own row in a new worksheet called 'Hosted Domains', with the source IP in column A and the domain in column B.
You want to cross-reference co-hosted domains against a known-bad domain list in another worksheet
For each IP in column A, retrieve co-hosted domains from IP2Location.io and write each domain on its own row in a new worksheet 'Hosted Domains'. Then in column C, mark 'FLAGGED' if the domain appears in the 'Known Bad Domains' worksheet column A, and 'CLEAN' otherwise.
Some of your 30 IPs returned hundreds of domains — you want a count column to prioritize
For each IP in column A, retrieve co-hosted domains from IP2Location.io and write the full list comma-separated to column B. In column C, write the count of co-hosted domains. Sort the workbook by column C descending so the most-shared IPs surface first.
Full reverse-IP enrichment, cross-reference, dedup, and fraud scope summary in one shot
For each IP in column A, retrieve all co-hosted domains from IP2Location.io and write each on its own row in a new worksheet 'Hosted Domains' with source IP in column A and domain in column B. Mark column C 'FLAGGED' if the domain appears in 'Known Bad Domains' worksheet column A, 'CLEAN' otherwise. Count total flagged and clean on a new worksheet called 'Scope Summary' with counts in B1 and B2.
You don't have to build the analysis after you finish the lookups — ask for both in the same prompt.
Try It
If you have an Excel workbook with suspected phishing or spam IPs and need to map the co-hosted domains, Get the 7-day free trial of SheetXAI and ask it to run the reverse IP lookups via IP2Location.io. For WHOIS registration data on the domains you find, see the WHOIS lookup guide or the full hub overview.