DAdatadome
Top Threats

Gets top threat IPs

Returns the IP addresses responsible for the most bad bot traffic on your account over the requested time window, so they can be fed into your own WAF, CDN or edge blocklist. Accounts with an active DDoS Protect subscription also receive IP addresses blocked server-side by DataDome's edge protection, merged into the same list.

Change: this endpoint replaces /api/protection/ai-threat-detected-ips, which is deprecated but still served for existing integrations. Its responses carry Deprecation and Link headers. New integrations use /1.1/protection/ai-threat-detected-ips (/1.0/protection/ai-threat-detected-ips also works). Responses on /1.x are always application/json (a plain array), and application/ld+json returns 406.

get/1.1/protection/ai-threat-detected-ips

Request

  • Base URL
    https://customer-api.datadome.co
  • URL
    https://customer-api.datadome.co/1.1/protection/ai-threat-detected-ips
  • Auth
    API key in header x-api-key

Query parameters

date[after]string

Unix timestamp (seconds) that defines the start of the window for which to fetch threat IPs. Defaults to the start of your account's data retention window.

date[before]string

Unix timestamp (seconds) that defines the end of the window for which to fetch threat IPs. Default is now.

Response

Gets the IP addresses that generated the most bad bot traffic over the requested period, ordered by request count descending.

ipstring
requestCountinteger
asNamestring nullable
asNumberstring nullable
ruleNamesTopstring[]

Changes

No recorded changes to this operation across all 1 revision of this API.