Using the GreyNoise Community API

API Information

The Community API provides a free resource to members to allow for quick IP lookups in the GreyNoise datasets.

API Address: api.greynoise.io/v3/community
Available to unauthenticated users with a limited number of lookups per day
API docs

IP Lookup via Community API

Query an IP via the Community API and see basic information on what GreyNoise knows about that IP.

noise: If true, this IP has been observed scanning the internet in the last 90 days
riot: If true, this IP was found in the RIOT project dataset
classification: The GreyNoise classification for this IP
name: Name of Organization that Owns the IP
link: https://viz.greynoise.io/riot/1.1.1.1
last_seen: 2020-01-01

import requests

url = "https://api.greynoise.io/v3/community/212.115.85.236"

headers = {
  'key': '{{gn_api_key}}'
}

response = requests.request("GET", url, headers=headers)

print(response.text)

curl -s api.greynoise.io/v3/community/8.8.8.8

API Responses

HTTP code 200 - Successful Lookup - Noise IP

{
    "ip":"51.91.185.74",
    "noise":true,
    "riot":false,
    "classification":"malicious",
    "name":"unknown",
    "link":"https://viz.greynoise.io/ip/51.91.185.74",
    "last_seen":"2021-03-18",
    "message":"Success"
}

HTTP code 200 - Successful Lookup - RIOT IP

{
    "ip": "1.1.1.1",
    "noise": false,
    "riot": true,
    "classification": "benign",
    "name": "Cloudflare",
    "link": "https://viz.greynoise.io/riot/1.1.1.1",
    "last_seen": "2020-01-01",
    "message" : "Success"
}

HTTP code 400 - Invalid Request

{
    "message": "Request is not a valid routable IPv4 address"
}

HTTP code 401 - Authentication Error

{
    "message": "Authentication Error has Occurred, check your API Key"
}

HTTP code 404 - IP Not Found in GreyNoise

{
    "ip":"196.188.245.219",
    "noise":false,
    "riot":false,
    "message":"IP not observed scanning the internet or contained in RIOT data set."
}

HTTP code 429 - Daily Rate-Limit Exceeded

{
    "plan": "unauthenticated",
    "rate-limit": "10 IP lookups per day",
    "plan_url": "https://greynoise.io/pricing",
    "message": "You have hit your current rate limit 10 IP lookups per  day. Please create a free account or upgrade your plan at https://greynoise.io/pricing."
}

HTTP code 500 - Internal Error

{
  "message": "Internal Server Error - Unable to perform request to GreyNoise Community API"
}