According to the API docs, IP addresses *can* be in the hashset:
https://developers.google.com/safe-browsing/v4/urls-hashing#canonicalization
however, as i have come to learn, GSB is focused on "resource threats" meaning that a very specific resource contains a threat. as such, the likelihood of a IP address alone being in the GSB is extremely low, if such were to ever exist at all.
GSB does not (yet - hopefully someday!) have any sort of ranking system for domains, subdomains, or url "paths".
so, a lookup for
http://1.2.3.4/ would ONLY ever make it into the hash if GSB determine that nearly every resource that would be supplied by that IP address were unsafe.
however,
http://1.2.3.4/svc/subgroup/?parm=1 could be in the GSB. unfortunately, you cannot get a list of all threats that are prefixed with a domain or IP. you have to know EXACTLY the resource that you want info about.
also, know that GSB's api implementation is NOT the same thing as Google's threat checking website. so, you can't really validate your tests by comparing that with the API.
Regards,
Eriq