---
updatedAt: 2026-04-29T22:56:06.000Z
agentTools:
  projectIndex: https://docs.greynoise.io/llms.txt
---

# Callback IP Lookup

Retrieve detailed information about a specific callback IP, including
attack stage, scanner associations, and downloaded malware files.


# OpenAPI definition

```json
{
  "openapi": "3.0.0",
  "info": {
    "description": "GreyNoise is a cybersecurity company that collects and analyzes Internet-wide scan and attack traffic. Use GreyNoise to contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats.",
    "version": "3.0.0",
    "title": "GreyNoise API",
    "contact": {
      "email": "hello@greynoise.io"
    },
    "license": {
      "name": "Proprietary",
      "url": "https://www.greynoise.io/terms"
    }
  },
  "security": [
    {
      "APIKeyHeaderAuth": []
    }
  ],
  "paths": {
    "/v1/callback/ip/{ip}": {
      "get": {
        "tags": [
          "Callback"
        ],
        "summary": "Callback IP Lookup",
        "operationId": "CallbackGetIP",
        "description": "Retrieve detailed information about a specific callback IP, including\nattack stage, scanner associations, and downloaded malware files.\n",
        "parameters": [
          {
            "name": "ip",
            "in": "path",
            "description": "The callback IP address to look up.",
            "required": true,
            "schema": {
              "type": "string",
              "example": "198.51.100.42"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "OK - callback IP details returned.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CallbackIPDetailResponse"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/UnexpectedError"
          }
        }
      }
    }
  },
  "servers": [
    {
      "url": "https://api.greynoise.io"
    },
    {
      "url": "http://api.greynoise.io"
    }
  ],
  "components": {
    "securitySchemes": {
      "APIKeyHeaderAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "key"
      }
    },
    "responses": {
      "NotFound": {
        "description": "Resource not found.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "IP not found"
            }
          }
        }
      },
      "BadRequest": {
        "description": "Bad request - request syntax is invalid for the specified endpoint.\nVerify request syntax and try again.\n",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Invalid parameter"
            }
          }
        }
      },
      "Unauthorized": {
        "description": "Unauthorized. Please check your API key.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Unauthorized"
            }
          }
        }
      },
      "Forbidden": {
        "description": "Forbidden - request is not authorized due to an invalid API key or plan limitations.\nIf due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results.\n",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Forbidden"
            }
          }
        }
      },
      "UnexpectedError": {
        "description": "Unexpected error",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Encountered error while performing request"
            }
          }
        }
      }
    },
    "schemas": {
      "ErrorMessage": {
        "type": "object",
        "properties": {
          "message": {
            "type": "string"
          }
        },
        "required": [
          "message"
        ]
      },
      "CallbackFileResponse": {
        "type": "object",
        "description": "Malware file associated with a callback IP.",
        "properties": {
          "sha256": {
            "type": "string",
            "description": "SHA-256 hash of the file.",
            "example": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
          },
          "md5": {
            "type": "string",
            "description": "MD5 hash of the file."
          },
          "sha1": {
            "type": "string",
            "description": "SHA-1 hash of the file."
          },
          "threat_name": {
            "type": "string",
            "description": "VirusTotal threat name, if available.",
            "example": "Trojan.GenericKD.46542"
          },
          "vt_detection_count": {
            "type": "integer",
            "description": "Number of VirusTotal engines that flagged the file as malicious.",
            "example": 42
          },
          "vt_engine_count": {
            "type": "integer",
            "description": "Total number of VirusTotal engines that scanned the file.",
            "example": 71
          },
          "file_name": {
            "type": "string",
            "description": "Original file name, if known.",
            "example": "payload.bin"
          },
          "size": {
            "type": "integer",
            "format": "int64",
            "description": "File size in bytes.",
            "example": 24576
          },
          "type": {
            "type": "string",
            "description": "File MIME type.",
            "example": "application/x-executable"
          }
        }
      },
      "CallbackIPDetailResponse": {
        "type": "object",
        "description": "Detailed information about a single callback IP.",
        "properties": {
          "ip": {
            "type": "string",
            "description": "The callback IP address.",
            "example": "198.51.100.42"
          },
          "source_workspaces": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Labeled workspace sources where this IP was observed.\nValues are \"GreyNoise\", \"Personal\", or \"Community\".\n",
            "example": [
              "GreyNoise",
              "Personal"
            ]
          },
          "attack_stage": {
            "type": "integer",
            "minimum": 0,
            "maximum": 2,
            "nullable": true,
            "deprecated": true,
            "description": "Deprecated. Use is_stage_1 / is_stage_2 instead."
          },
          "is_stage_1": {
            "type": "boolean",
            "description": "Whether a file was successfully downloaded from this IP (stage 1)."
          },
          "is_stage_2": {
            "type": "boolean",
            "description": "Whether this IP is suspected C2 based on VT/sandbox analysis (stage 2)."
          },
          "is_riot": {
            "type": "boolean",
            "description": "Whether this IP belongs to a known benign service (RIOT)."
          },
          "riot_trust_level": {
            "type": "integer",
            "minimum": 1,
            "maximum": 3,
            "description": "RIOT trust level (1-3), present only for RIOT IPs."
          },
          "first_seen": {
            "type": "string",
            "nullable": true,
            "description": "ISO 8601 timestamp of when this IP was first observed.",
            "example": "2025-03-01T00:00:00Z"
          },
          "last_seen": {
            "type": "string",
            "nullable": true,
            "description": "ISO 8601 timestamp of when this IP was most recently observed.",
            "example": "2025-03-15T12:30:00Z"
          },
          "scanner_ips": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Scanner IPs that delivered payloads referencing this callback IP.",
            "example": [
              "203.0.113.7",
              "192.0.2.99"
            ]
          },
          "scanner_count": {
            "type": "integer",
            "description": "Number of distinct scanners associated with this IP.",
            "example": 5
          },
          "file_count": {
            "type": "integer",
            "description": "Number of malware files associated with this IP.",
            "example": 3
          },
          "active_files": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CallbackFileResponse"
            },
            "description": "Malware files associated with this callback IP."
          },
          "enrichment": {
            "$ref": "#/components/schemas/CallbackIPEnrichment"
          }
        }
      },
      "CallbackIPEnrichment": {
        "type": "object",
        "description": "Geolocation and network enrichment for a callback IP.",
        "properties": {
          "asn": {
            "type": "string",
            "example": "AS4837"
          },
          "org": {
            "type": "string",
            "example": "CHINA UNICOM China169 Backbone"
          },
          "city": {
            "type": "string",
            "example": "Qingdao"
          },
          "region": {
            "type": "string",
            "example": "Shandong"
          },
          "country": {
            "type": "string",
            "example": "China"
          },
          "country_code": {
            "type": "string",
            "example": "CN"
          },
          "latitude": {
            "type": "number",
            "example": 36.0649
          },
          "longitude": {
            "type": "number",
            "example": 120.3804
          },
          "is_tor": {
            "type": "boolean"
          },
          "route": {
            "type": "string",
            "example": "119.176.0.0/12"
          },
          "type": {
            "type": "string",
            "example": "isp"
          },
          "domain": {
            "type": "string",
            "example": "chinaunicom.cn"
          },
          "rdns": {
            "type": "string"
          }
        }
      }
    }
  }
}
```