What this endpoint does

This endpoint downloads a bulk file of IP addresses from the Recorded Future IP risk list, intended for ingestion into SIEMs, SOARs, firewalls, and other security tools. By default it returns the "default" risk list; use the list parameter with a risk rule name to filter to IPs that trigger a specific rule and have a risk score of 25 or above. Use the IP Risk Rules endpoint to retrieve valid risk rule names and see how many IPs each rule covers. The response is a file download (not paginated JSON), available in CSV/Splunk format by default or in STIX 1.1.1, STIX 1.2, or STIX 2.1 formats. Use the companion HEAD endpoint to retrieve an ETag hash for change-detection polling without downloading the full file.

Response data

The default CSV format contains four columns: Name (the bare IP address), Risk (numeric score 0-99), RiskString (triggered rules vs total rules evaluated), and EvidenceDetails (a JSON-encoded array of evidence objects including rule name, evidence string, criticality label, source citations, and timestamps for each triggered rule). The file size varies significantly by risk rule — broad rules like "Historically Reported in Threat List" cover over 100 million IPs, while specific rules like "Recent SSH/Dictionary Attacker" return a more targeted set.