---
title: "List Callback IPs"
method: POST
path: "/v1/callback/ips"
tags: ["Callback"]
---

# List Callback IPs

`POST /v1/callback/ips`

Retrieve a paginated list of callback IPs with filtering by attack
stage, date ranges, file attributes, and scanner associations.

## Request body

- CallbackListIPsRequest — Common filter fields for callback IP queries.
  - `is_stage_1` boolean — Filter by stage 1 status. true = file downloaded from this IP.
  - `is_stage_2` boolean — Filter by stage 2 status. true = suspected C2 based on VT/sandbox analysis.
  - `first_seen_after` string, date — Only include IPs first seen after this date (YYYY-MM-DD).
  - `first_seen_before` string, date — Only include IPs first seen before this date (YYYY-MM-DD).
  - `last_seen_after` string, date — Only include IPs last seen after this date (YYYY-MM-DD).
  - `last_seen_before` string, date — Only include IPs last seen before this date (YYYY-MM-DD).
  - `has_files` boolean — If true, only include IPs with associated malware files. If false, only IPs without files.
  - `file_type` string — Filter by file MIME type (e.g. "application/x-executable").
  - `file_name` string — Filter by file name substring match.
  - `file_hash` string — Filter by file SHA256 hash.
  - `scanner_ips` string[] — Filter to IPs associated with these scanner IPs.
  - `ips` string[] — Filter to this specific set of callback IPs.
  - `page` integer — Zero-indexed page number.
  - `page_size` integer — Number of results per page (1-100).

## Response `200`

OK - paginated list of callback IPs returned.

- CallbackListIPsResponse — Paginated list of callback IPs.
  - `items` CallbackIPSummary[]
    - `ip` string
    - `source_workspaces` string[]
    - `attack_stage` integer, nullable — Deprecated. Use is_stage_1 / is_stage_2 instead.
    - `is_stage_1` boolean
    - `is_stage_2` boolean
    - `is_riot` boolean
    - `riot_trust_level` integer — RIOT trust level (1-3), present only for RIOT IPs.
    - `first_seen` string, nullable
    - `last_seen` string, nullable
    - `scanner_ips` string[]
    - `scanner_count` integer
    - `file_count` integer
    - `files` CallbackFileSummary[] — Lightweight file references for this IP.
      - `sha256` string — SHA-256 hash of the file.
      - `file_name` string — Original file name.
      - `type` string — File MIME type.
      - `vt_threat_name` string — VirusTotal threat name.
      - `vt_detection_count` integer — Number of VirusTotal engines that flagged the file.
    - `enrichment` CallbackIPEnrichment — Geolocation and network enrichment for a callback IP.
      - `asn` string
      - `org` string
      - `city` string
      - `region` string
      - `country` string
      - `country_code` string
      - `latitude` number
      - `longitude` number
      - `is_tor` boolean
      - `route` string
      - `type` string
      - `domain` string
      - `rdns` string
  - `total` integer — Total number of matching callback IPs.
  - `page` integer — Current page number (zero-indexed).
  - `page_size` integer — Number of results per page.

## Other responses

- `400` — Bad request - request syntax is invalid for the specified endpoint. Verify request syntax and try again.
- `401` — Unauthorized. Please check your API key.
- `403` — Forbidden - request is not authorized due to an invalid API key or plan limitations. If due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results.
- `500` — Unexpected error

---

[API](https://skmtc.net/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.net/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/versions/30942574656d/schema)