The Scenario
The brand protection team handed you a list of 50 suspected phishing IPs this morning. The ask is specific: for each IP, find out what other domains are hosted on the same server. If multiple phishing IPs are pointing to the same hosting cluster, that's the lead the legal team needs to move quickly. The data has to be in the workbook in a format the lawyers can read — not in your browser's back-stack.
The bad version:
- Pull up a reverse-IP lookup tool, paste the first IP, copy the domain list, paste it into the workbook.
- Repeat 49 more times, realize partway through that some IPs return twenty hosted domains and others return two hundred — and you've been pasting them into a single column, which means the row alignment for the source IP is now completely wrong.
- Rebuild the structure, decide to separate each IP's results onto its own set of rows with the source IP repeated, and realize you now have to go back and redo the first thirty.
50 IPs sounds manageable. The moment the structure question surfaces — one row per IP, or one row per hosted domain? — the manual approach starts to collapse.
The Easy Way: One Prompt in SheetXAI
SheetXAI is an AI agent that lives inside your Excel workbook. It reads the IP column and through its built-in IP2Location integration calls the hosted-domains endpoint for each address, then structures the results exactly how you describe — one row per domain, with the source IP carried along.
Look up all hosted domains for the IPs in column A using IP2Location and write each domain on its own row in a new worksheet called 'Hosted Domains', with the source IP in column A and the domain in column B.
What You Get
- A new "Hosted Domains" worksheet created automatically
- Column A in that worksheet: the source IP address, repeated for each domain it hosts
- Column B: one domain per row
- IPs that return no hosted domains get a single row with the IP and "no results" so nothing goes missing from your original list
What If the Data Is Not Quite Ready
I also want a comma-separated version for a quick visual scan
For each IP in column A, use IP2Location to retrieve the list of hosted domains and write them as a comma-separated list to column B of the source worksheet, and also create the detailed one-row-per-domain layout on a new "Hosted Domains" worksheet.
I want to flag IPs that share hosted domains with other IPs on my list
After building the "Hosted Domains" worksheet from IP2Location results, add a column C to that worksheet that flags any domain that appears under more than one source IP from my original list, writing SHARED in column C for those rows.
I need to cross-reference the hosted domains against a known-bad-domains list
After writing all hosted domains to "Hosted Domains" with source IPs in column A and domains in column B, check each domain in column B against the "Known Bad Domains" worksheet column A — write MATCH in column C if found, CLEAN if not.
Full kill chain — enrich, structure, deduplicate shared clusters, and flag
Run IP2Location hosted-domain lookup for all IPs in column A, write one-row-per-domain results to "Hosted Domains" with source IP in column A and domain in column B. Flag any domain shared by more than one source IP with SHARED in column C. Then add a "Cluster Summary" worksheet listing each shared domain and all the IPs pointing to it.
The cluster summary at the end is the piece that makes this usable for legal — it shows the infrastructure pattern, not just a flat domain list.
Try It
Get the 7-day free trial of SheetXAI and open any workbook with a list of suspicious IP addresses, then ask it to run IP2Location hosted-domain lookups and build the structured output your investigation needs. You can also see how this works for WHOIS domain research or return to the IP2Location overview for the full integration guide.