What this endpoint does

This endpoint searches for IP addresses matching specified filters and returns paginated results with optional enrichment data. Filters include risk score range, specific risk rule (use the IP Risk Rules endpoint for valid rule names), first/last seen date windows, and sorting by risk score, recency, or hit counts. IP-specific filters include range for searching within a CIDR block or IP range (e.g., 64.227.176.0/20) and location for filtering by geography. Each page returns up to 1,000 results with a maximum pagination window of 10,000 total results. Use the fields parameter to control which enrichment data is included for each result — without it, only basic entity identification is returned.

Response data

The response contains a results array where each entry includes the IP entity identification and any enrichment sections specified in the fields parameter (matching the same field options as the IP Lookup endpoint, such as entity, risk, location, links, and aiInsights). A counts object reports how many results were returned in this page and how many total results match the filters. Combine riskRule with orderBy=riskscore&direction=desc to surface the highest-risk IPs for a specific threat category, or use range with risk filters to assess the threat density within a specific network block.