Real-time IP Risk and IP Hotlist feeds now available

← All updates · May 19, 2026

Added

• Real-time IP Risk Feed — Continuously updated feed of high-risk IP addresses hosting domains, scored across threat type, geolocation, and ASN. Designed for integration into TIPs, SIEMs, and data lakes to enrich blocking and detection workflows with current IP risk context.

• Real-time IP Hotlist Feed — A curated subset of the IP Risk Feed containing only the highest-risk IPs: those where more than 50% of hosted domains are high-risk and show passive DNS activity. Suitable for high-confidence blocking and alerting use cases.

Both feeds are available alongside the existing domain-based Real-time Threat Feeds (Domain Risk, Domain Hotlist, Newly Observed Domains, Newly Observed Hostnames, Newly Active Domains, and Domain Discovery).

Documentation

• Real-time IP Risk Feed
• Real-time IP Hotlist Feed
• Threat Feeds overview

Categories: Threat Feeds, IP Risk, IP Hotlist