Find IP addresses by risk score, threat rules, dates, or geolocation with paginated enrichment results.
What this endpoint does
This endpoint searches for IP addresses matching specified filters and returns paginated results with optional enrichment data. Filters include risk score range, specific risk rule (use the IP Risk Rules endpoint for valid rule names), first/last seen date windows, and sorting by risk score, recency, or hit counts. IP-specific filters include range for searching within a CIDR block or IP range (e.g., 64.227.176.0/20) and location for filtering by geography. Each page returns up to 1,000 results with a maximum pagination window of 10,000 total results. Use the fields parameter to control which enrichment data is included for each result — without it, only basic entity identification is returned.
Response data
The response contains a results array where each entry includes the IP entity identification and any enrichment sections specified in the fields parameter (matching the same field options as the IP Address: Lookup endpoint, such as entity, risk, location, links, and aiInsights). A counts object reports how many results were returned in this page and how many total results match the filters. Combine riskRule with orderBy=riskscore&direction=desc to surface the highest-risk IPs for a specific threat category, or use range with risk filters to assess the threat density within a specific network block.
Paginated with offset-based pagination; limit max 1,000 and limit + from cannot exceed 1,000. Results are under data.results, with counts as a sibling of data. The limit parameter has a default value of 10. The intention is to use pagination to get further results. Though limit can be set to higher values, depending on which fields are used for enrichment, this might result in slower queries and possibly even time outs.