IP Lookup
IP Lookup
Get more information about a given IP address. Returns time ranges, IP metadata (network owner, ASN, reverse DNS pointer, country), associated actors, activity tags, and raw port scan and web request information.
Use the quick parameter to return a subset of the response fields, for a faster response time.
get/v3/ip/{ip}
Path parameters
ipstring required
IP address to query
Query parameters
quickboolean
If true, the response will only include the IP address and the classification or trust level.
workspace_labelsstring
Example:greynoise,community
Comma-separated list of dataset scopes to include in the query. When omitted, only the default GreyNoise global dataset is queried.
Allowed values:
- greynoise: GreyNoise's global dataset.
- community: Aggregated community-contributed data.
- personal: The authenticated caller's own workspace data. Requires an authenticated workspace.
Enforcement varies by endpoint; see each operation's response codes:
- GET /v3/ip/{ip} and POST /v3/ip return 403 Forbidden when any value is supplied without the Community Dataset entitlement. Values are not validated server-side; unrecognized values yield empty results rather than an error.
- GET /v3/noise/ips/{ip}/timeline returns 400 Bad Request for unrecognized values and for personal without an authenticated workspace. The Community Dataset entitlement is not enforced on this endpoint.
Response
OK - request successful.
Example response
{
"ip": "8.8.8.8",
"business_service_intelligence": {
"found": true,
"category": "hosting",
"name": "example.com",
"description": "example.com",
"last_updated": "2025-01-15T12:30:45Z",
"reference": "https://example.com",
"trust_level": "1"
},
"internet_scanner_intelligence": {
"ip": "71.6.135.131",
"seen": true,
"classification": "benign",
"first_seen": "2018-01-28",
"last_seen": "2018-02-28",
"last_seen_timestamp": "2025-01-15T12:30:45Z",
"found": true,
"actor": "Shodan.io",
"spoofable": true,
"cves": [
"CVE-2020-1234",
"CVE-2021-2345"
],
"vpn": true,
"vpn_service": "IPVANISH_VPN",
"metadata": {
"source_country": "United States",
"source_country_code": "US",
"source_city": "Seattle",
"region": "Seattle",
"organization": "DigitalOcean, LLC",
"rdns": "crawl-66-249-79-17.googlebot.com",
"asn": "AS521",
"asn_subnet": "203.0.113.0/24",
"category": "education",
"os": "Windows 7/8",
"destination_countries": [
"Germany"
],
"destination_country_codes": [
"Germany"
],
"destination_cities": [
"Berlin"
],
"destination_asns": [
"AS1234"
],
"single_destination": true,
"carrier": "AIS",
"datacenter": "us-west-1",
"domain": "example.com",
"rdns_parent": "example.com",
"rdns_validated": true,
"latitude": 37.7749,
"longitude": -122.4194,
"sensor_count": 10,
"sensor_hits": 10
},
"tags": {
"id": "ef0cc90d-d80c-436f-92c5-3d8f8665c9ac",
"slug": "mirai",
"name": "Mirai",
"category": "worm",
"intention": "malicious",
"description": "This IP address exhibits behavior that indicates it is infected with Mirai or a Mirai-like variant of malware.",
"references": [
"https://en.wikipedia.org/wiki/Mirai_(malware)"
],
"cves": [
"CVE-2020-1234"
],
"created_at": "2020-04-07",
"updated_at": "2020-04-07"
},
"raw_data": {
"scan": [
{
"port": 80,
"protocol": "TCP"
}
],
"ja3": [
{
"fingerprint": "c3a6cf0bf2e690ac8e1ecf6081f17a50",
"port": 443
}
],
"hassh": [
{
"fingerprint": "51cba57125523ce4b9db67714a90bf6e",
"port": 2222
}
],
"http": {
"md5": "9764955b67107eeb9edfae76f429e783",
"cookie_keys": [
"expremotekey"
],
"request_authorization": [
"Bearer exampletoken",
"Basic username:password"
],
"request_cookies": [
"session_id=1234567890"
],
"request_header": [
"Content-Type: application/json",
"Accept: application/json"
],
"method": [
"GET",
"POST",
"PUT",
"DELETE"
],
"request_origin": [
"111.111.1.1"
],
"host": [
"example.com",
"example.com:8080"
],
"path": [
"/robots.txt"
],
"useragent": [
"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\n"
],
"ja4h": [
"ge11cn060000_4e59edc1297a_4da5efaf0cbd"
]
},
"tls": {
"cipher": "TLS_AES_128_GCM_SHA256",
"ja4": [
"t13d1516h2_8daaf6152771_02713d6af862"
]
},
"ssh": {
"key": [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1234567890"
],
"ja4ssh": [
"c76s76_c71s59_c0s0"
]
},
"tcp": {
"ja4t": [
"64240_2-1-3-1-1-4_1460_8"
],
"ja4l": "1460_64"
},
"source": {
"bytes": 1024
}
}
},
"request_metadata": {
"restricted_fields": [
"ip",
"cve",
"destination_cities"
]
}
}