v1

latestOpenAPI 3.0.0Proprietary2026-07-244990150.4 KB

Callback

Callback IP Lookup

Retrieve detailed information about a specific callback IP, including attack stage, scanner associations, and downloaded malware files.

get/v1/callback/ip/{ip}

Path parameters

ipstring required

Example:198.51.100.42

The callback IP address to look up.

Response

OK - callback IP details returned.

ipstring

The callback IP address.

source_workspacesstring[]

Labeled workspace sources where this IP was observed. Values are "GreyNoise", "Personal", or "Community".

attack_stageinteger nullable

Deprecated. Use is_stage_1 / is_stage_2 instead.

is_stage_1boolean

Whether a file was successfully downloaded from this IP (stage 1).

is_stage_2boolean

Whether this IP is suspected C2 based on VT/sandbox analysis (stage 2).

is_riotboolean

Whether this IP belongs to a known benign service (RIOT).

riot_trust_levelinteger

RIOT trust level (1-3), present only for RIOT IPs.

first_seenstring nullable

ISO 8601 timestamp of when this IP was first observed.

last_seenstring nullable

ISO 8601 timestamp of when this IP was most recently observed.

scanner_ipsstring[]

Scanner IPs that delivered payloads referencing this callback IP.

scanner_countinteger

Number of distinct scanners associated with this IP.

file_countinteger

Number of malware files associated with this IP.

Example response

{
  "ip": "198.51.100.42",
  "source_workspaces": [
    "GreyNoise",
    "Personal"
  ],
  "first_seen": "2025-03-01T00:00:00Z",
  "last_seen": "2025-03-15T12:30:00Z",
  "scanner_ips": [
    "203.0.113.7",
    "192.0.2.99"
  ],
  "scanner_count": 5,
  "file_count": 3,
  "active_files": [
    {
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "threat_name": "Trojan.GenericKD.46542",
      "vt_detection_count": 42,
      "vt_engine_count": 71,
      "file_name": "payload.bin",
      "size": 24576,
      "type": "application/x-executable"
    }
  ],
  "enrichment": {
    "asn": "AS4837",
    "org": "CHINA UNICOM China169 Backbone",
    "city": "Qingdao",
    "region": "Shandong",
    "country": "China",
    "country_code": "CN",
    "latitude": 36.0649,
    "longitude": 120.3804,
    "route": "119.176.0.0/12",
    "type": "isp",
    "domain": "chinaunicom.cn"
  }
}