--- title: "IP Lookup" method: GET path: "/v3/ip/{ip}" tags: ["IP Lookup"] --- # IP Lookup `GET /v3/ip/{ip}` Get more information about a given IP address. Returns time ranges, IP metadata (network owner, ASN, reverse DNS pointer, country), associated actors, activity tags, and raw port scan and web request information. Use the `quick` parameter to return a subset of the response fields, for a faster response time. ## Path parameters - `ip` string, required ## Query parameters - `quick` boolean - `workspace_labels` string ## Response `200` OK - request successful. - union - IPResponseV3 - `ip` string — IP address that the information is about. - `business_service_intelligence` BusinessServiceIntelligence - `found` boolean — Indicates if an IP is part of the RIOT dataset or not. - `category` string — RIOT category the provider belongs to, identifying the type of service provided. - `name` string — The name of the provider and/or service. - `description` string — A description of the provider and what they do. - `explanation` string — An explanation of the category type and what may be expected from this provider and category. - `last_updated` string — Date and time when this record was last updated from its source (format: YYYY-MM-DDTHH:MM:SSZ). - `reference` string — Reference URL for information about this provider and/or service. - `trust_level` string — Trust level assigned to this IP/provider. One of: - "1" — high trust; broadly used legitimate provider where end-user attribution is high. - "2" — moderate trust; common business service infrastructure where end-user attribution is limited. - "3" — label only; cloud compute or bulk hosting provider with no inherent trust signal. - `internet_scanner_intelligence` InternetScannerIntelligence - `ip` string — IP address that the information is about. - `seen` boolean — Whether or not the IP address has been observed by the GreyNoise sensor network. - `classification` 'benign' | 'malicious' | 'unknown' — The classification of the IP address, either "benign", "malicious", or "unknown", based on the activity observed by GreyNoise. - `first_seen` string, date — The earliest date GreyNoise observed any activity from this IP. - `last_seen` string, date — The most recent date GreyNoise observed any activity from this IP. - `last_seen_timestamp` string, date-time — The timestamp of the last observed activity from this IP. - `found` boolean — Indicates if the IP was observed scanning the GreyNoise sensor network. Also referred to as 'noise'. - `actor` string — The overt actor this IP is associated with. - `spoofable` boolean — This IP address has been opportunistically scanning the Internet, however has failed to complete a full TCP connection. Any reported activity could be spoofed. - `cves` string[] — A list of CVEs associate with this IP. - `tor` boolean — Whether or not the device is a known Tor exit node. - `vpn` boolean — This IP is associated with a VPN service. Activity, malicious or otherwise, should not be attributed to the VPN service provider. - `vpn_service` string — Name of associated VPN Service. - `metadata` MetadataV3 - `mobile` boolean — Defines if the IP is part of a known cellular network. - `source_country` string — Country where the IP address is registered or operates. - `source_country_code` string — Country code of the IP address based on ISO 3166-1 alpha-2. - `source_city` string — The city where the device is geographically located. - `region` string — The region where the device is geographically located. - `organization` string — The name of organization that owns the IP address. - `rdns` string — The reverse DNS pointer. - `asn` string — The autonomous system identification number. - `asn_subnet` string — The latest-observed ASN subnet for the IP in GreyNoise scan data, not authoritative current BGP state. - `category` 'isp' | 'business' | 'hosting' | 'mobile' | 'education' — The subset of network types the IP address belongs to. - `os` string — An approximate guess of the operating system of the device, based on the TCP stack fingerprint. - `destination_countries` string[] - `destination_country_codes` string[] - `destination_cities` string[] - `destination_asns` string[] - `single_destination` boolean — A Boolean parameter indicating whether the source IP address has only been observed in a single destination country. - `carrier` string — The Internet Service Provider (ISP) or telecommunications carrier associated with the source IP address. - `datacenter` string — The datacenter or hosting provider from which the activity originates. This could indicate the use of cloud services, managed hosting, or enterprise datacenter infrastructure. - `domain` string — The domain name associated with the source IP address. - `rdns_parent` string — The parent domain retrieved through reverse DNS (RDNS) lookup of the source IP address. - `rdns_validated` boolean — A validation status that confirms whether the reverse DNS (RDNS) record correctly maps to the source domain. - `latitude` number — The geographic latitude of the source IP address. - `longitude` number — The geographic longitude of the source IP address. - `sensor_count` integer — Number of sensors with events observed. - `sensor_hits` integer — Number of scanning events observed. - `tags` IPResponseV3Tags - `id` string — The unique identifier for the tag. - `slug` string — The slugified version of the tag name. - `name` string — The human-readable name for the tag. - `category` string — Category of the IP address such as hosting or ISP. - `intention` string — The intent of the tag, either suspicious, malicious, benign, or unknown. - `description` string — A detailed description of the tag, including the observed activity and any relevant context or details. - `references` string[] - `recommend_block` boolean — A boolean value indicating whether the tag should be recommended for blocking or filtering purposes. - `cves` string[] - `created_at` string — The date and time when the tag was created. - `updated_at` string — The date and time when the tag was last updated. - `raw_data` object — Raw data observed directly by GreyNoise. - `scan` object[] - `port` integer — Port number - `protocol` string — Protocol - `ja3` object[] - `fingerprint` string — JA3 hash fingerprint string - `port` integer — TCP port connection that the SSL/TLS communication occurred over - `hassh` object[] - `fingerprint` string — HASSH hash fingerprint string - `port` integer — TCP port connection where the HASSH hash was identified - `http` object - `md5` string — An MD5 hash of the body content. This compact, unique representation of the data allows for quick comparisons and deduplication of payloads without storing the raw content. - `cookie_keys` string[] — The keys or names of cookies exchanged in the communication. These can reveal session identifiers, tracking mechanisms, or other metadata used in web interactions, providing clues about application behavior or vulnerabilities. - `request_authorization` string[] — The contents of the Authorization header in a request, which can include credentials, tokens, or other authentication information. - `request_cookies` string[] — Key-value pairs stored in cookies sent with an HTTP request. These cookies often contain session identifiers, user preferences, or tracking data, which can be analyzed to detect unauthorized access or manipulation. - `request_header` string[] — Request Headers are the keys (names) of HTTP headers that a client sends to a server. - `method` string[] — The HTTP method used in the request, such as GET, POST, PUT, or DELETE. Analyzing methods can reveal the intent of the request, such as retrieving or modifying resources, and identify unexpected or suspicious activity. - `request_origin` string[] — Indicates the origin of the request, typically used in cross-origin resource sharing (CORS) to specify where the request originated. This helps identify unauthorized or potentially malicious cross-origin requests. - `host` string[] — The host of the request, which can include the domain name and port number. These values can provide insight into the services or endpoints the actor may have been attempting to interact with. - `uri` string[] - `path` string[] - `useragent` string[] - `ja4h` string[] - `tls` object - `cipher` string — The encryption algorithm or cipher suite used during the secure communication. Identifying the cipher helps assess the security of the connection, particularly in TLS/SSL traffic. - `ja4` string[] - `ssh` object - `key` string[] — This is the SSH key used. - `ja4ssh` string[] - `tcp` object - `ja4t` string[] - `ja4l` string — JA4L light distance/latency fingerprint observed in network traffic from the IP. Captures TCP TTL and window size characteristics, useful for estimating client-server distance and identifying proxied connections. - `source` object - `bytes` integer — The total amount of data transferred (in bytes) during the observed session or connection. - `request_metadata` object - `restricted_fields` string[] — The fields that were restricted due to plan limitations. - QuickIpProfile - `ip` string — IP address that the information is about. - `business_service_intelligence` QuickBusinessServiceIntelligence - `found` boolean — Indicates if an IP is part of the RIOT dataset or not. - `trust_level` string — Trust level assigned to this IP/provider. One of: - "1" — high trust; broadly used legitimate provider where end-user attribution is high. - "2" — moderate trust; common business service infrastructure where end-user attribution is limited. - "3" — label only; cloud compute or bulk hosting provider with no inherent trust signal. - `internet_scanner_intelligence` QuickInternetScannerIntelligence - `found` boolean — Indicates if the IP was observed scanning the GreyNoise sensor network. Also referred to as 'noise'. - `classification` 'benign' | 'malicious' | 'unknown' — The classification of the IP address, either "benign", "malicious", or "unknown", based on the activity observed by GreyNoise. ## Other responses - `206` — Partial content - request partially successful. Due to plan limitations, your request only returned a subset of fields and/or data. Contact sales@greynoise.io to upgrade your plan and unlock full results. - `400` — Bad request - request syntax is invalid for the specified endpoint. Verify request syntax and try again. - `401` — Unauthorized. Please check your API key. - `403` — Forbidden - request is not authorized due to an invalid API key or plan limitations. If due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results. - `429` — Too many requests. You've hit the rate-limit. --- [API](https://skmtc.dev/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.dev/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/revisions/30942574656d/schema)