openapi: 3.0.0 info: title: GreyNoise Callback IP Lookup API version: 3.0.0 description: GreyNoise is a cybersecurity company that collects and analyzes Internet-wide scan and attack traffic. Use GreyNoise to contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats. contact: email: hello@greynoise.io license: name: Proprietary url: https://www.greynoise.io/terms servers: - url: https://api.greynoise.io description: Production security: - APIKeyHeaderAuth: [] tags: - name: IP Lookup description: Calls to identify whether or not an IP address is noise, or get more information about a given IP address. paths: /v3/ip: post: tags: - IP Lookup summary: IP Lookup - Multi operationId: V3MultiIP description: 'Retrieves information about the submitted set of IP addresses from the Internet Scanner and Business Service intelligence datasets (consolidated response based on subscription entitlements). Returns time ranges, IP metadata (network owner, ASN, reverse DNS pointer, country), associated actors, tags, raw port scan data, web request information, classification and/or trust level, and provider information. Use the `quick` parameter to return a subset of the response fields, for a faster response time. Can process up to 10,000 IPs per request. ' requestBody: $ref: '#/components/requestBodies/MultiIpRequest' parameters: - in: query name: quick description: If true, the response will only include the IP address and the classification or trust level. required: false schema: type: boolean default: false - $ref: '#/components/parameters/workspaceLabels' responses: '200': description: OK - request successful. content: application/json: schema: oneOf: - $ref: '#/components/schemas/MultiIPResponseV3' - $ref: '#/components/schemas/QuickMultiIPResponseV3' examples: V3MultiIP200Example: summary: Default V3MultiIP 200 response x-microcks-default: true value: data: - ip: 8.8.8.8 business_service_intelligence: found: true category: hosting name: example.com description: example.com explanation: string last_updated: '2025-01-15T12:30:45Z' reference: https://example.com trust_level: '1' internet_scanner_intelligence: ip: 71.6.135.131 seen: true classification: benign first_seen: '2018-01-28' last_seen: '2018-02-28' last_seen_timestamp: '2025-01-15T12:30:45Z' found: true actor: Shodan.io spoofable: true cves: &id001 - CVE-2020-1234 - CVE-2021-2345 tor: false vpn: true vpn_service: IPVANISH_VPN metadata: mobile: false source_country: United States source_country_code: US source_city: Seattle region: Seattle organization: DigitalOcean, LLC rdns: crawl-66-249-79-17.googlebot.com asn: AS521 category: education os: Windows 7/8 destination_countries: &id002 - string destination_country_codes: &id003 - US destination_cities: &id004 - string destination_asns: &id005 - string single_destination: true carrier: AIS datacenter: us-west-1 domain: example.com rdns_parent: example.com rdns_validated: true latitude: 37.7749 longitude: -122.4194 sensor_count: 10 sensor_hits: 10 tags: id: ef0cc90d-d80c-436f-92c5-3d8f8665c9ac slug: mirai name: Mirai category: worm intention: malicious description: This IP address exhibits behavior that indicates it is infected with Mirai or a Mirai-like variant of malware. references: &id006 - string recommend_block: false cves: &id007 - CVE-2021-44228 created_at: '2020-04-07' updated_at: '2020-04-07' raw_data: scan: - port: 80 protocol: TCP ja3: - fingerprint: c3a6cf0bf2e690ac8e1ecf6081f17a50 port: 443 hassh: - fingerprint: 51cba57125523ce4b9db67714a90bf6e port: 2222 http: md5: 9764955b67107eeb9edfae76f429e783 cookie_keys: &id008 - expremotekey request_authorization: &id009 - Bearer exampletoken - Basic username:password request_cookies: &id010 - session_id=1234567890 request_header: &id011 - 'Content-Type: application/json' - 'Accept: application/json' method: &id012 - GET - POST - PUT - DELETE request_origin: &id013 - 111.111.1.1 host: &id014 - example.com - example.com:8080 uri: &id015 - string path: &id016 - /HNAP1/ useragent: &id017 - Mozilla/5.0 (compatible; GoogleBot/2.1; +http://www.google.com/bot.html) ja4h: &id018 - ge11cn060000_4e59edc1297a_4da5efaf0cbd tls: cipher: TLS_AES_128_GCM_SHA256 ja4: &id019 - t13d1516h2_8daaf6152771_02713d6af862 ssh: key: &id020 - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1234567890 ja4ssh: &id021 - c76s76_c71s59_c0s0 tcp: ja4t: &id022 - 64240_2-1-3-1-1-4_1460_8 ja4l: '1460_64' source: string request_metadata: restricted_fields: &id023 - ip - cve - destination_cities message: ok ips_not_found: &id024 - string '206': description: 'Partial content - request partially successful. Due to plan limitations, your request only returned a subset of fields and/or data. Contact sales@greynoise.io to upgrade your plan and unlock full results. ' content: application/json: schema: oneOf: - $ref: '#/components/schemas/MultiIPResponseV3' - $ref: '#/components/schemas/QuickMultiIPResponseV3' examples: V3MultiIP206Example: summary: Default V3MultiIP 206 response x-microcks-default: true value: data: - ip: 8.8.8.8 business_service_intelligence: found: true category: hosting name: example.com description: example.com explanation: string last_updated: '2025-01-15T12:30:45Z' reference: https://example.com trust_level: '1' internet_scanner_intelligence: ip: 71.6.135.131 seen: true classification: benign first_seen: '2018-01-28' last_seen: '2018-02-28' last_seen_timestamp: '2025-01-15T12:30:45Z' found: true actor: Shodan.io spoofable: true cves: *id001 tor: false vpn: true vpn_service: IPVANISH_VPN metadata: mobile: false source_country: United States source_country_code: US source_city: Seattle region: Seattle organization: DigitalOcean, LLC rdns: crawl-66-249-79-17.googlebot.com asn: AS521 category: education os: Windows 7/8 destination_countries: *id002 destination_country_codes: *id003 destination_cities: *id004 destination_asns: *id005 single_destination: true carrier: AIS datacenter: us-west-1 domain: example.com rdns_parent: example.com rdns_validated: true latitude: 37.7749 longitude: -122.4194 sensor_count: 10 sensor_hits: 10 tags: id: ef0cc90d-d80c-436f-92c5-3d8f8665c9ac slug: mirai name: Mirai category: worm intention: malicious description: This IP address exhibits behavior that indicates it is infected with Mirai or a Mirai-like variant of malware. references: *id006 recommend_block: false cves: *id007 created_at: '2020-04-07' updated_at: '2020-04-07' raw_data: scan: - port: 80 protocol: TCP ja3: - fingerprint: c3a6cf0bf2e690ac8e1ecf6081f17a50 port: 443 hassh: - fingerprint: 51cba57125523ce4b9db67714a90bf6e port: 2222 http: md5: 9764955b67107eeb9edfae76f429e783 cookie_keys: *id008 request_authorization: *id009 request_cookies: *id010 request_header: *id011 method: *id012 request_origin: *id013 host: *id014 uri: *id015 path: *id016 useragent: *id017 ja4h: *id018 tls: cipher: TLS_AES_128_GCM_SHA256 ja4: *id019 ssh: key: *id020 ja4ssh: *id021 tcp: ja4t: *id022 ja4l: '1460_64' source: string request_metadata: restricted_fields: *id023 message: ok ips_not_found: *id024 '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/ExceededLimit' x-microcks-operation: delay: 0 dispatcher: FALLBACK /v3/ip/{ip}: get: tags: - IP Lookup summary: IP Lookup operationId: V3IP description: 'Get more information about a given IP address. Returns time ranges, IP metadata (network owner, ASN, reverse DNS pointer, country), associated actors, activity tags, and raw port scan and web request information. Use the `quick` parameter to return a subset of the response fields, for a faster response time. ' parameters: - $ref: '#/components/parameters/ip' - in: query name: quick description: If true, the response will only include the IP address and the classification or trust level. required: false schema: type: boolean default: false - $ref: '#/components/parameters/workspaceLabels' responses: '200': description: OK - request successful. content: application/json: schema: oneOf: - $ref: '#/components/schemas/IPResponseV3' - $ref: '#/components/schemas/QuickIpProfile' examples: V3IP200Example: summary: Default V3IP 200 response x-microcks-default: true value: ip: 8.8.8.8 business_service_intelligence: found: true category: hosting name: example.com description: example.com explanation: string last_updated: '2025-01-15T12:30:45Z' reference: https://example.com trust_level: '1' internet_scanner_intelligence: ip: 71.6.135.131 seen: true classification: benign first_seen: '2018-01-28' last_seen: '2018-02-28' last_seen_timestamp: '2025-01-15T12:30:45Z' found: true actor: Shodan.io spoofable: true cves: &id025 - CVE-2020-1234 - CVE-2021-2345 tor: false vpn: true vpn_service: IPVANISH_VPN metadata: mobile: false source_country: United States source_country_code: US source_city: Seattle region: Seattle organization: DigitalOcean, LLC rdns: crawl-66-249-79-17.googlebot.com asn: AS521 category: education os: Windows 7/8 destination_countries: &id026 - string destination_country_codes: &id027 - US destination_cities: &id028 - string destination_asns: &id029 - string single_destination: true carrier: AIS datacenter: us-west-1 domain: example.com rdns_parent: example.com rdns_validated: true latitude: 37.7749 longitude: -122.4194 sensor_count: 10 sensor_hits: 10 tags: id: ef0cc90d-d80c-436f-92c5-3d8f8665c9ac slug: mirai name: Mirai category: worm intention: malicious description: This IP address exhibits behavior that indicates it is infected with Mirai or a Mirai-like variant of malware. references: &id030 - string recommend_block: false cves: &id031 - CVE-2021-44228 created_at: '2020-04-07' updated_at: '2020-04-07' raw_data: scan: - port: 80 protocol: TCP ja3: - fingerprint: c3a6cf0bf2e690ac8e1ecf6081f17a50 port: 443 hassh: - fingerprint: 51cba57125523ce4b9db67714a90bf6e port: 2222 http: md5: 9764955b67107eeb9edfae76f429e783 cookie_keys: &id032 - expremotekey request_authorization: &id033 - Bearer exampletoken - Basic username:password request_cookies: &id034 - session_id=1234567890 request_header: &id035 - 'Content-Type: application/json' - 'Accept: application/json' method: &id036 - GET - POST - PUT - DELETE request_origin: &id037 - 111.111.1.1 host: &id038 - example.com - example.com:8080 uri: &id039 - string path: &id040 - /HNAP1/ useragent: &id041 - Mozilla/5.0 (compatible; GoogleBot/2.1; +http://www.google.com/bot.html) ja4h: &id042 - ge11cn060000_4e59edc1297a_4da5efaf0cbd tls: cipher: TLS_AES_128_GCM_SHA256 ja4: &id043 - t13d1516h2_8daaf6152771_02713d6af862 ssh: key: &id044 - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1234567890 ja4ssh: &id045 - c76s76_c71s59_c0s0 tcp: ja4t: &id046 - 64240_2-1-3-1-1-4_1460_8 ja4l: '1460_64' source: string request_metadata: restricted_fields: &id047 - ip - cve - destination_cities '206': description: 'Partial content - request partially successful. Due to plan limitations, your request only returned a subset of fields and/or data. Contact sales@greynoise.io to upgrade your plan and unlock full results. ' content: application/json: schema: oneOf: - $ref: '#/components/schemas/IPResponseV3' - $ref: '#/components/schemas/QuickIpProfile' examples: V3IP206Example: summary: Default V3IP 206 response x-microcks-default: true value: ip: 8.8.8.8 business_service_intelligence: found: true category: hosting name: example.com description: example.com explanation: string last_updated: '2025-01-15T12:30:45Z' reference: https://example.com trust_level: '1' internet_scanner_intelligence: ip: 71.6.135.131 seen: true classification: benign first_seen: '2018-01-28' last_seen: '2018-02-28' last_seen_timestamp: '2025-01-15T12:30:45Z' found: true actor: Shodan.io spoofable: true cves: *id025 tor: false vpn: true vpn_service: IPVANISH_VPN metadata: mobile: false source_country: United States source_country_code: US source_city: Seattle region: Seattle organization: DigitalOcean, LLC rdns: crawl-66-249-79-17.googlebot.com asn: AS521 category: education os: Windows 7/8 destination_countries: *id026 destination_country_codes: *id027 destination_cities: *id028 destination_asns: *id029 single_destination: true carrier: AIS datacenter: us-west-1 domain: example.com rdns_parent: example.com rdns_validated: true latitude: 37.7749 longitude: -122.4194 sensor_count: 10 sensor_hits: 10 tags: id: ef0cc90d-d80c-436f-92c5-3d8f8665c9ac slug: mirai name: Mirai category: worm intention: malicious description: This IP address exhibits behavior that indicates it is infected with Mirai or a Mirai-like variant of malware. references: *id030 recommend_block: false cves: *id031 created_at: '2020-04-07' updated_at: '2020-04-07' raw_data: scan: - port: 80 protocol: TCP ja3: - fingerprint: c3a6cf0bf2e690ac8e1ecf6081f17a50 port: 443 hassh: - fingerprint: 51cba57125523ce4b9db67714a90bf6e port: 2222 http: md5: 9764955b67107eeb9edfae76f429e783 cookie_keys: *id032 request_authorization: *id033 request_cookies: *id034 request_header: *id035 method: *id036 request_origin: *id037 host: *id038 uri: *id039 path: *id040 useragent: *id041 ja4h: *id042 tls: cipher: TLS_AES_128_GCM_SHA256 ja4: *id043 ssh: key: *id044 ja4ssh: *id045 tcp: ja4t: *id046 ja4l: '1460_64' source: string request_metadata: restricted_fields: *id047 '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/ExceededLimit' x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: IpResponseMetadataV3: type: object properties: restricted_fields: type: array description: 'The fields that were restricted due to plan limitations. ' example: - ip - cve - destination_cities items: type: string message: type: string example: ok description: A status message indicating if there were issues with the request ips_not_found: type: array description: 'The list of IPs not found ' items: type: string example: - string IPResponseV3Tags: type: object properties: id: type: string example: ef0cc90d-d80c-436f-92c5-3d8f8665c9ac description: 'The unique identifier for the tag. ' slug: type: string example: mirai description: 'The slugified version of the tag name. ' name: type: string example: Mirai description: 'The human-readable name for the tag. ' category: type: string example: worm description: 'Category of the IP address such as hosting or ISP. ' intention: type: string example: malicious description: 'The intent of the tag, either suspicious, malicious, benign, or unknown. ' description: type: string example: This IP address exhibits behavior that indicates it is infected with Mirai or a Mirai-like variant of malware. description: 'A detailed description of the tag, including the observed activity and any relevant context or details. ' references: type: array items: type: string example: https://en.wikipedia.org/wiki/Mirai_(malware) description: 'A list of URLs or references that provide additional information about the tag and its associated activity. ' example: - string recommend_block: type: boolean example: false description: 'A boolean value indicating whether the tag should be recommended for blocking or filtering purposes. ' cves: type: array items: type: string example: CVE-2020-1234 description: 'A list of CVEs associated with the tag. ' example: - CVE-2021-44228 created_at: type: string example: '2020-04-07' description: 'The date and time when the tag was created. ' updated_at: type: string example: '2020-04-07' description: 'The date and time when the tag was last updated. ' BusinessServiceIntelligence: properties: found: type: boolean description: 'Indicates if an IP is part of the RIOT dataset or not. ' example: true category: type: string description: 'RIOT category the provider belongs to, identifying the type of service provided. ' example: hosting name: type: string description: 'The name of the provider and/or service. ' example: example.com description: type: string description: 'A description of the provider and what they do. ' example: example.com explanation: type: string description: 'An explanation of the category type and what may be expected from this provider and category. ' example: string last_updated: type: string description: 'Date and time when this record was last updated from its source (format: YYYY-MM-DDTHH:MM:SSZ). ' example: '2025-01-15T12:30:45Z' reference: type: string description: 'Reference URL for information about this provider and/or service. ' example: https://example.com trust_level: type: string description: "Trust level assigned to this IP/provider. One of:\n - \"1\" — high trust; broadly used legitimate provider where end-user attribution is high.\n - \"2\" — moderate trust; common business service infrastructure where end-user attribution is limited.\n - \"3\" — label only; cloud compute or bulk hosting provider with no inherent trust signal.\n" example: '1' QuickInternetScannerIntelligence: type: object properties: found: type: boolean description: 'Indicates if the IP was observed scanning the GreyNoise sensor network. Also referred to as ''noise''. ' example: false classification: type: string description: 'The classification of the IP address, either "benign", "malicious", or "unknown", based on the activity observed by GreyNoise. ' enum: - benign - malicious - unknown example: benign MultiIPResponseV3: type: object properties: data: type: array items: type: object properties: ip: type: string example: 8.8.8.8 description: IP address that the information is about. business_service_intelligence: $ref: '#/components/schemas/BusinessServiceIntelligence' internet_scanner_intelligence: $ref: '#/components/schemas/InternetScannerIntelligence' request_metadata: $ref: '#/components/schemas/IpResponseMetadataV3' IPResponseV3: type: object properties: ip: type: string example: 8.8.8.8 description: 'IP address that the information is about. ' business_service_intelligence: $ref: '#/components/schemas/BusinessServiceIntelligence' internet_scanner_intelligence: $ref: '#/components/schemas/InternetScannerIntelligence' request_metadata: type: object properties: restricted_fields: type: array description: 'The fields that were restricted due to plan limitations. ' example: - ip - cve - destination_cities items: type: string QuickMultiIPResponseV3: type: object properties: data: type: array items: type: object properties: ip: type: string example: 8.8.8.8 description: IP address that the information is about. business_service_intelligence: $ref: '#/components/schemas/QuickBusinessServiceIntelligence' internet_scanner_intelligence: $ref: '#/components/schemas/QuickInternetScannerIntelligence' request_metadata: $ref: '#/components/schemas/IpResponseMetadataV3' QuickIpProfile: type: object properties: ip: type: string example: 8.8.8.8 description: IP address that the information is about. business_service_intelligence: $ref: '#/components/schemas/QuickBusinessServiceIntelligence' internet_scanner_intelligence: $ref: '#/components/schemas/QuickInternetScannerIntelligence' InternetScannerIntelligence: properties: ip: type: string description: IP address that the information is about. example: 71.6.135.131 seen: type: boolean description: Whether or not the IP address has been observed by the GreyNoise sensor network. example: true classification: type: string description: The classification of the IP address, either "benign", "malicious", or "unknown", based on the activity observed by GreyNoise. enum: - benign - malicious - unknown example: benign first_seen: type: string description: The earliest date GreyNoise observed any activity from this IP. format: date example: '2018-01-28' last_seen: type: string description: The most recent date GreyNoise observed any activity from this IP. format: date example: '2018-02-28' last_seen_timestamp: type: string description: The timestamp of the last observed activity from this IP. format: date-time example: '2025-01-15T12:30:45Z' found: type: boolean description: Indicates if the IP was observed scanning the GreyNoise sensor network. Also referred to as 'noise'. example: true actor: type: string description: The overt actor this IP is associated with. example: Shodan.io spoofable: type: boolean description: This IP address has been opportunistically scanning the Internet, however has failed to complete a full TCP connection. Any reported activity could be spoofed. example: true cves: type: array items: type: string description: A list of CVEs associate with this IP. example: - CVE-2020-1234 - CVE-2021-2345 tor: type: boolean description: Whether or not the device is a known Tor exit node. example: false vpn: type: boolean description: This IP is associated with a VPN service. Activity, malicious or otherwise, should not be attributed to the VPN service provider. example: true vpn_service: type: string description: Name of associated VPN Service. example: IPVANISH_VPN metadata: $ref: '#/components/schemas/MetadataV3' tags: $ref: '#/components/schemas/IPResponseV3Tags' raw_data: type: object description: Raw data observed directly by GreyNoise. properties: scan: type: array items: type: object properties: port: type: integer description: Port number example: 80 protocol: type: string description: Protocol example: TCP ja3: type: array items: type: object properties: fingerprint: type: string example: c3a6cf0bf2e690ac8e1ecf6081f17a50 description: JA3 hash fingerprint string port: type: integer example: 443 description: TCP port connection that the SSL/TLS communication occurred over hassh: type: array items: type: object properties: fingerprint: type: string example: 51cba57125523ce4b9db67714a90bf6e description: HASSH hash fingerprint string port: type: integer example: 2222 description: 'TCP port connection where the HASSH hash was identified ' http: type: object properties: md5: type: string description: 'An MD5 hash of the body content. This compact, unique representation of the data allows for quick comparisons and deduplication of payloads without storing the raw content. ' example: 9764955b67107eeb9edfae76f429e783 cookie_keys: type: array description: 'The keys or names of cookies exchanged in the communication. These can reveal session identifiers, tracking mechanisms, or other metadata used in web interactions, providing clues about application behavior or vulnerabilities. ' example: - expremotekey items: type: string request_authorization: type: array description: 'The contents of the Authorization header in a request, which can include credentials, tokens, or other authentication information. ' example: - Bearer exampletoken - Basic username:password items: type: string request_cookies: type: array description: 'Key-value pairs stored in cookies sent with an HTTP request. These cookies often contain session identifiers, user preferences, or tracking data, which can be analyzed to detect unauthorized access or manipulation. ' example: - session_id=1234567890 items: type: string request_header: type: array description: 'Request Headers are the keys (names) of HTTP headers that a client sends to a server. ' example: - 'Content-Type: application/json' - 'Accept: application/json' items: type: string method: type: array description: 'The HTTP method used in the request, such as GET, POST, PUT, or DELETE. Analyzing methods can reveal the intent of the request, such as retrieving or modifying resources, and identify unexpected or suspicious activity. ' example: - GET - POST - PUT - DELETE items: type: string request_origin: type: array description: 'Indicates the origin of the request, typically used in cross-origin resource sharing (CORS) to specify where the request originated. This helps identify unauthorized or potentially malicious cross-origin requests. ' example: - 111.111.1.1 items: type: string host: type: array description: 'The host of the request, which can include the domain name and port number. These values can provide insight into the services or endpoints the actor may have been attempting to interact with. ' example: - example.com - example.com:8080 items: type: string uri: type: array items: type: string description: 'The URI of the request, which can include the path and query parameters. This can provide insight into the specific resource or data being requested. ' example: - string path: type: array items: type: string description: Observed scanning activity traversed this web path. example: /robots.txt example: - /HNAP1/ useragent: type: array items: type: string description: Observed scanning activity used these user agents. example: 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) ' example: - Mozilla/5.0 (compatible; GoogleBot/2.1; +http://www.google.com/bot.html) ja4h: type: array items: type: string description: 'List of JA4H HTTP client fingerprints observed in network traffic from the IP. JA4H captures characteristics of HTTP client behavior including method, headers, and cookie fields, useful for identifying and tracking HTTP clients. ' example: - ge11cn060000_4e59edc1297a_4da5efaf0cbd tls: type: object properties: cipher: type: string description: 'The encryption algorithm or cipher suite used during the secure communication. Identifying the cipher helps assess the security of the connection, particularly in TLS/SSL traffic. ' example: TLS_AES_128_GCM_SHA256 ja4: type: array items: type: string description: 'List of JA4 TLS fingerprints observed in network traffic from the IP. JA4 is a modern fingerprinting method that captures distinctive characteristics of TLS client behavior, useful for identifying and clustering malicious or anomalous clients. ' example: - t13d1516h2_8daaf6152771_02713d6af862 ssh: type: object properties: key: type: array description: 'This is the SSH key used. ' example: - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1234567890 items: type: string ja4ssh: type: array items: type: string description: 'List of JA4SSH fingerprints observed in network traffic from the IP. JA4SSH captures SSH traffic patterns including packet lengths and directions, useful for identifying SSH client behavior and detecting anomalous sessions. ' example: - c76s76_c71s59_c0s0 tcp: type: object properties: ja4t: type: array items: type: string description: 'List of JA4T TCP fingerprints observed in network traffic from the IP. JA4T captures TCP connection characteristics such as window size, options, and MSS, useful for OS fingerprinting and identifying network stacks. ' example: - 64240_2-1-3-1-1-4_1460_8 ja4l: type: string description: 'JA4L light distance/latency fingerprint observed in network traffic from the IP. Captures TCP TTL and window size characteristics, useful for estimating client-server distance and identifying proxied connections. ' example: '1460_64' source: properties: bytes: type: integer description: 'The total amount of data transferred (in bytes) during the observed session or connection. ' example: 1024 example: string MetadataV3: properties: mobile: type: boolean description: Defines if the IP is part of a known cellular network. example: false source_country: type: string description: Country where the IP address is registered or operates. example: United States source_country_code: type: string description: Country code of the IP address based on ISO 3166-1 alpha-2. example: US source_city: type: string description: The city where the device is geographically located. example: Seattle region: type: string description: The region where the device is geographically located. example: Seattle organization: type: string description: The name of organization that owns the IP address. example: DigitalOcean, LLC rdns: type: string description: The reverse DNS pointer. example: crawl-66-249-79-17.googlebot.com asn: type: string description: The autonomous system identification number. example: AS521 category: type: string description: The subset of network types the IP address belongs to. enum: - isp - business - hosting - mobile - education example: education os: type: string description: An approximate guess of the operating system of the device, based on the TCP stack fingerprint. example: Windows 7/8 destination_countries: type: array items: type: string description: 'The full name or country code where GreyNoise sensor is physically located. ' example: Germany example: - string destination_country_codes: type: array items: type: string description: 'The country codes where GreyNoise sensor is physically located. ' example: Germany example: - US destination_cities: type: array items: type: string description: 'The city where the GreyNoise sensor is geographically located. ' example: Berlin example: - string destination_asns: type: array items: type: string description: 'The ASN associated with the destination IP address. ' example: AS1234 example: - string single_destination: type: boolean description: 'A Boolean parameter indicating whether the source IP address has only been observed in a single destination country. ' example: true carrier: type: string description: 'The Internet Service Provider (ISP) or telecommunications carrier associated with the source IP address. ' example: AIS datacenter: type: string description: 'The datacenter or hosting provider from which the activity originates. This could indicate the use of cloud services, managed hosting, or enterprise datacenter infrastructure. ' example: us-west-1 domain: type: string description: 'The domain name associated with the source IP address. ' example: example.com rdns_parent: type: string description: 'The parent domain retrieved through reverse DNS (RDNS) lookup of the source IP address. ' example: example.com rdns_validated: type: boolean description: 'A validation status that confirms whether the reverse DNS (RDNS) record correctly maps to the source domain. ' example: true latitude: type: number description: 'The geographic latitude of the source IP address. ' example: 37.7749 longitude: type: number description: 'The geographic longitude of the source IP address. ' example: -122.4194 sensor_count: type: integer description: 'Number of sensors with events observed. ' example: 10 sensor_hits: type: integer description: 'Number of scanning events observed. ' example: 10 QuickBusinessServiceIntelligence: type: object properties: found: type: boolean description: 'Indicates if an IP is part of the RIOT dataset or not. ' example: false trust_level: type: string description: "Trust level assigned to this IP/provider. One of:\n - \"1\" — high trust; broadly used legitimate provider where end-user attribution is high.\n - \"2\" — moderate trust; common business service infrastructure where end-user attribution is limited.\n - \"3\" — label only; cloud compute or bulk hosting provider with no inherent trust signal.\n" example: '1' Error: type: object properties: message: type: string example: Success required: - message parameters: ip: name: ip in: path description: IP address to query required: true schema: type: string example: 8.8.8.8 workspaceLabels: name: workspace_labels in: query description: "Comma-separated list of dataset scopes to include in the query.\nWhen omitted, only the default GreyNoise global dataset is queried.\n\nAllowed values:\n- `greynoise`: GreyNoise's global dataset.\n- `community`: Aggregated community-contributed data.\n- `personal`: The authenticated caller's own workspace data.\n Requires an authenticated workspace.\n\nEnforcement varies by endpoint; see each operation's response codes:\n- `GET /v3/ip/{ip}` and `POST /v3/ip` return `403 Forbidden` when any\n value is supplied without the Community Dataset entitlement. Values\n are not validated server-side; unrecognized values yield empty\n results rather than an error.\n- `GET /v3/noise/ips/{ip}/timeline` returns `400 Bad Request` for\n unrecognized values and for `personal` without an authenticated\n workspace. The Community Dataset entitlement is not enforced on\n this endpoint.\n" required: false schema: type: string example: greynoise,community example: string responses: Forbidden: description: 'Forbidden - request is not authorized due to an invalid API key or plan limitations. If due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results. ' content: application/json: schema: $ref: '#/components/schemas/Error' example: message: Forbidden Unauthorized: description: Unauthorized. Please check your API key. content: application/json: schema: $ref: '#/components/schemas/Error' example: message: Unauthorized ExceededLimit: description: Too many requests. You've hit the rate-limit. content: application/json: schema: $ref: '#/components/schemas/Error' example: message: You've hit the rate limit for this endpoint. BadRequest: description: 'Bad request - request syntax is invalid for the specified endpoint. Verify request syntax and try again. ' content: application/json: schema: $ref: '#/components/schemas/Error' example: message: Invalid parameter securitySchemes: APIKeyHeaderAuth: type: apiKey in: header name: key description: GreyNoise API key passed via the 'key' HTTP header.