---
title: "Callback Overview Statistics"
method: POST
path: "/v1/callback/overview"
tags: ["Callback"]
---

# Callback Overview Statistics

`POST /v1/callback/overview`

Retrieve aggregate statistics for callback IPs including counts by
attack stage, file analysis status, scanner associations, and top
threat names.

## Request body

- CallbackFilterFields — Common filter fields for callback IP queries.
  - `is_stage_1` boolean — Filter by stage 1 status. true = file downloaded from this IP.
  - `is_stage_2` boolean — Filter by stage 2 status. true = suspected C2 based on VT/sandbox analysis.
  - `first_seen_after` string, date — Only include IPs first seen after this date (YYYY-MM-DD).
  - `first_seen_before` string, date — Only include IPs first seen before this date (YYYY-MM-DD).
  - `last_seen_after` string, date — Only include IPs last seen after this date (YYYY-MM-DD).
  - `last_seen_before` string, date — Only include IPs last seen before this date (YYYY-MM-DD).
  - `has_files` boolean — If true, only include IPs with associated malware files. If false, only IPs without files.
  - `file_type` string — Filter by file MIME type (e.g. "application/x-executable").
  - `file_name` string — Filter by file name substring match.
  - `file_hash` string — Filter by file SHA256 hash.
  - `scanner_ips` string[] — Filter to IPs associated with these scanner IPs.
  - `ips` string[] — Filter to this specific set of callback IPs.

## Response `200`

OK - overview statistics returned.

- CallbackOverviewResponse — Aggregate statistics for callback IPs matching the given filters.
  - `total_ips` integer — Total number of callback IPs.
  - `stage_1_ips` integer — Number of stage 1 (initial payload delivery) IPs.
  - `stage_2_ips` integer — Number of stage 2 (post-exploitation callback) IPs.
  - `unconfirmed_ips` integer — Number of IPs not yet confirmed as stage 1 or stage 2.
  - `total_files` integer — Total number of associated malware files.
  - `files_with_vt` integer — Files that have been analyzed by VirusTotal.
  - `files_without_vt` integer — Files pending VirusTotal analysis.
  - `total_cross_refs` integer — Total IP-to-file associations.
  - `total_scanner_links` integer — Total scanner-to-callback-IP associations.
  - `ips_with_files` integer — Number of IPs that have associated files.
  - `ips_without_files` integer — Number of IPs with no associated files.
  - `ips_with_scanners` integer — Number of IPs with known scanner associations.
  - `ips_without_scanners` integer — Number of IPs with no known scanner associations.
  - `distinct_scanners` integer — Total number of unique scanner IPs.
  - `riot_level_1_ips` integer — Number of IPs at RIOT trust level 1.
  - `riot_level_2_ips` integer — Number of IPs at RIOT trust level 2.
  - `riot_level_3_ips` integer — Number of IPs at RIOT trust level 3.
  - `not_riot_ips` integer — Number of IPs not classified as RIOT.
  - `top_threat_names` CallbackThreatNameStat[] — Top VirusTotal threat names by file count.
    - `threat_name` string — VirusTotal threat name.
    - `file_count` integer — Number of files with this threat name.
    - `ip_count` integer — Number of IPs associated with files of this threat name.

## Other responses

- `400` — Bad request - request syntax is invalid for the specified endpoint. Verify request syntax and try again.
- `401` — Unauthorized. Please check your API key.
- `403` — Forbidden - request is not authorized due to an invalid API key or plan limitations. If due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results.
- `500` — Unexpected error

---

[API](https://skmtc.net/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.net/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/versions/30942574656d/schema)