The Scenario
Your fraud team flagged 250 checkout orders as suspicious — high order values, new accounts, billing and shipping addresses in different countries. The IP address for each checkout is already in your Google Sheet, column A, alongside order IDs and amounts.
Before anyone escalates these to the fraud review queue, the team wants each IP tagged: is it a VPN exit node? A known proxy? A TOR relay? How many blacklists is it on?
Right now that information doesn't exist in the sheet. Without it, the fraud analyst has to open BigDataCloud's web interface, look up IPs one at a time, and copy the risk flags into the sheet by hand.
The bad version:
- Open BigDataCloud's hazard report endpoint documentation, run a curl command for the first IP, decode the response fields.
- Realize there are 250 rows and the manual lookup is going to take the rest of the afternoon.
- Export the list, hand it to the developer on the team, ask them to write a batch script — now the fraud team is blocked until the script is ready and tested.
The escalation meeting is at 4 PM and the list is still untagged.
The Easy Way: One Prompt in SheetXAI
SheetXAI is an AI agent that lives inside your Google Sheet. It reads your data, calls BigDataCloud's hazard report API across your IP column, and writes the risk flags back into adjacent columns — no script required.
Open SheetXAI from the Extensions menu and type:
Run a BigDataCloud hazard report on every IP in column A and write is_vpn, is_proxy, is_tor, and blacklist count into columns B through E
What You Get
- Column B: is_vpn — true or false
- Column C: is_proxy — true or false
- Column D: is_tor — true or false
- Column E: blacklist_count — integer representing how many threat databases flagged this IP
- Any IP that BigDataCloud cannot resolve returns blank cells with a note in the SheetXAI sidebar listing the count of unresolved rows
What If the Data Is Not Quite Ready
The IP column includes duplicates — same IP appears across multiple orders
Run a BigDataCloud hazard report on every IP in column A — deduplicate before calling the API (look up each unique IP once), then write is_vpn, is_proxy, is_tor, and blacklist_count back to every row that shares that IP
You need the results highlighted, not just written as values
Check every IP in column A against BigDataCloud's hazard report and write is_vpn, is_proxy, is_tor, and blacklist_count into columns B through E — highlight the entire row red where any hazard flag is true or blacklist_count is greater than 0
Some rows are missing the IP — only order ID and amount are present
Run BigDataCloud hazard reports on column A — skip rows where column A is blank, mark those rows "no IP" in column B, and process the rest normally
Full risk triage in one pass
For every IP in column A, run a BigDataCloud hazard report — write is_vpn, is_proxy, is_tor, and blacklist_count into columns B through E, highlight flagged rows red, then on a new sheet called "Escalate" copy only the rows where at least one hazard flag is true, sorted by blacklist_count descending
The prompt handles the enrichment, the conditional formatting, and the escalation list in one shot.
Try It
Get the 7-day free trial of SheetXAI and open any Google Sheet with a column of IP addresses from suspicious transactions — paste the prompt above and have your fraud flags ready before the next review meeting. See the geolocation spoke if you also need country and region data for the same IP set.