exporting the IP addresses of malicious sources that are sending emails on behalf of domains

We would like to export the IP addresses of malicious sources that are sending emails on behalf of our domains. In the per sending source report, we can see the sending IP addresses, but there is no information about whether these addresses are from malicious sources or clean. I could see some details on the Thread Map reports. However, I don’t see the option to export the IP address details. Could you please provide the export option under Thread Map reports.