get https://api.greynoise.io/v3/similarity/ips/
If an IP is not found in this API, it means that GreyNoise has either never observed the IP or does not have enough information about that IP to determine similarity.
While comparing GreyNoise records, similarity is determined by having several features matching. This could be a similar set of ports, similar web paths queried, similar JA3 fingerprints, etc. When these are identified, we present which features are similar so the user can investigate the matches further.
- bot_bool: Whether or not this is from a bot network based on GreyNoise inference
- tor_bool: Whether or not this is from a TOR node based on GreyNoise inference
- vpn_bool: Whether or not this is from a VPN based on GreyNoise inference
- spoofable_bool: Whether or not this IP has completed a 3-way handshake. If not, it is potentially spoofed
- web_paths: Path of HTTP requests
- useragents: Useragent provided in request
- mass_scan_bool: Whether or not this IP is performing a mass scan based on GreyNoise inference
- ja3_fp: JA3 fingerprints associated with this IP
- hassh_fp: HASSH fingerprints associated with this IP
- rdns: Reverse DNS found for this IP
- os: OS detected for this IP
- ports: Ports used in traffic from this IP
Search Usage: This endpoint consumes one Search per API request.
License: This endpoint requires an additional subscription license to use.