---
title: "Gets top threat IPs"
method: GET
path: "/1.1/protection/ai-threat-detected-ips"
tags: ["Top Threats"]
---

# Gets top threat IPs

`GET /1.1/protection/ai-threat-detected-ips`

## Request

- Base URL: `https://customer-api.datadome.co`
- URL: `https://customer-api.datadome.co/1.1/protection/ai-threat-detected-ips`
- Auth: API key in header `x-api-key`

Returns the IP addresses responsible for the most bad bot traffic on your account over the requested time window, so they can be fed into your own WAF, CDN or edge blocklist. Accounts with an active DDoS Protect subscription also receive IP addresses blocked server-side by DataDome's edge protection, merged into the same list.

**Change:** this endpoint replaces `/api/protection/ai-threat-detected-ips`, which is deprecated but still served for existing integrations. Its responses carry `Deprecation` and `Link` headers. New integrations use `/1.1/protection/ai-threat-detected-ips` (`/1.0/protection/ai-threat-detected-ips` also works). Responses on `/1.x` are always `application/json` (a plain array), and `application/ld+json` returns `406`.

## Query parameters

- `date[after]` string
- `date[before]` string

## Response `200`

Gets the IP addresses that generated the most bad bot traffic over the requested period, ordered by request count descending.

- object[]
  - `ip` string
  - `requestCount` integer
  - `asName` string, nullable
  - `asNumber` string, nullable
  - `ruleNamesTop` string[]

## Other responses

- `400`: Lists the errors detected inside the request
- `429`: Too many requests. This endpoint accepts 200 requests per rolling 60-minute window, per API key. Requests beyond that are rejected without being served; the X-RateLimit-* response headers describe the limit in force and when the next request will be accepted.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/datadome/apis/management-api.md) - [All operations](https://skmtc.dev/datadome/apis/management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/datadome/apis/management-api/revisions/80062169b99e?raw)