GreyNoise
API Reference
Start typing to search…

List Callback IPs

post
https://api.greynoise.io/v1/callback/ips

Retrieve a paginated list of callback IPs with filtering by attack stage, date ranges, file attributes, and scanner associations.

Body Params
boolean

Filter by stage 1 status. true = file downloaded from this IP.

boolean

Filter by stage 2 status. true = suspected C2 based on VT/sandbox analysis.

date

Only include IPs first seen after this date (YYYY-MM-DD).

date

Only include IPs first seen before this date (YYYY-MM-DD).

date

Only include IPs last seen after this date (YYYY-MM-DD).

date

Only include IPs last seen before this date (YYYY-MM-DD).

boolean

If true, only include IPs with associated malware files. If false, only IPs without files.

string

Filter by file MIME type (e.g. "application/x-executable").

string

Filter by file name substring match.

string

Filter by file SHA256 hash.

scanner_ips
array of strings

Filter to IPs associated with these scanner IPs.

scanner_ips
ips
array of strings

Filter to this specific set of callback IPs.

ips
integer
≥ 0
Defaults to 0

Zero-indexed page number.

integer
1 to 100
Defaults to 20

Number of results per page (1-100).

Responses

Updated about 2 hours ago

Language
Credentials
Header
URL
Response 
Click Try It! to start a request and see the response here! Or choose an example:
application/json
Updated about 2 hours ago