---
title: "Callback IP Lookup"
method: GET
path: "/v1/callback/ip/{ip}"
tags: ["Callback"]
---

# Callback IP Lookup

`GET /v1/callback/ip/{ip}`

Retrieve detailed information about a specific callback IP, including
attack stage, scanner associations, and downloaded malware files.

## Path parameters

- `ip` string, required

## Response `200`

OK - callback IP details returned.

- CallbackIPDetailResponse — Detailed information about a single callback IP.
  - `ip` string — The callback IP address.
  - `source_workspaces` string[] — Labeled workspace sources where this IP was observed. Values are "GreyNoise", "Personal", or "Community".
  - `attack_stage` integer, nullable — Deprecated. Use is_stage_1 / is_stage_2 instead.
  - `is_stage_1` boolean — Whether a file was successfully downloaded from this IP (stage 1).
  - `is_stage_2` boolean — Whether this IP is suspected C2 based on VT/sandbox analysis (stage 2).
  - `is_riot` boolean — Whether this IP belongs to a known benign service (RIOT).
  - `riot_trust_level` integer — RIOT trust level (1-3), present only for RIOT IPs.
  - `first_seen` string, nullable — ISO 8601 timestamp of when this IP was first observed.
  - `last_seen` string, nullable — ISO 8601 timestamp of when this IP was most recently observed.
  - `scanner_ips` string[] — Scanner IPs that delivered payloads referencing this callback IP.
  - `scanner_count` integer — Number of distinct scanners associated with this IP.
  - `file_count` integer — Number of malware files associated with this IP.
  - `active_files` CallbackFileResponse[] — Malware files associated with this callback IP.
    - `sha256` string — SHA-256 hash of the file.
    - `md5` string — MD5 hash of the file.
    - `sha1` string — SHA-1 hash of the file.
    - `threat_name` string — VirusTotal threat name, if available.
    - `vt_detection_count` integer — Number of VirusTotal engines that flagged the file as malicious.
    - `vt_engine_count` integer — Total number of VirusTotal engines that scanned the file.
    - `file_name` string — Original file name, if known.
    - `size` integer — File size in bytes.
    - `type` string — File MIME type.
  - `enrichment` CallbackIPEnrichment — Geolocation and network enrichment for a callback IP.
    - `asn` string
    - `org` string
    - `city` string
    - `region` string
    - `country` string
    - `country_code` string
    - `latitude` number
    - `longitude` number
    - `is_tor` boolean
    - `route` string
    - `type` string
    - `domain` string
    - `rdns` string

## Other responses

- `400` — Bad request - request syntax is invalid for the specified endpoint. Verify request syntax and try again.
- `401` — Unauthorized. Please check your API key.
- `403` — Forbidden - request is not authorized due to an invalid API key or plan limitations. If due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results.
- `404` — Resource not found.
- `500` — Unexpected error

---

[API](https://skmtc.net/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.net/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/versions/30942574656d/schema)