GreyNoise API

Beginner's Pick Security / API Key Intermediate HTTPS

72 B

Metadata Score Metadata estimate · not endpoint-tested

Visit Official Site Compare Alternatives

Overview

GreyNoise analyzes internet-wide scanning activity and lets you look up any IP address to determine whether it is a known internet scanner, bot, or legitimate user. This helps security analysts cut through noise in logs and focus on truly suspicious traffic. The community API provides basic context for free without requiring a paid subscription.

Beginner Tip

Use the free community endpoint to check IPs from your server logs — if GreyNoise classifies an IP as "benign" (a known scanner), you can safely de-prioritize those alerts. Register for a free API key at viz.greynoise.io.

Available Data

The kind of data this API exposes, based on its documentation. We could not call the endpoint to confirm the exact field names.

IP address information

geographic location

ASN and ISP data

Example Response

Illustrative shape only — we were not able to call this endpoint (it requires credentials or exposes no public sample URL), so the fields below show the kind of data this API returns rather than a recorded response.

JSON Response · Illustrative

{
  "status": "success",
  "data": {
    "result": "Data from GreyNoise",
    "description": "Query IPs in the GreyNoise dataset and retrieve a subset of the full IP context data",
    "timestamp": "2025-01-15T10:00:00Z"
  }
}

Field Reference

ip The IP address that was looked up.

noise True if the IP is a known internet scanner generating background noise.

riot True if the IP belongs to a known benign service (e.g., Google, Cloudflare).

classification GreyNoise classification: malicious, benign, or unknown.

name Human-readable name of the organization or scanner associated with the IP.

Implementation Example

Calls a real endpoint of this API. Replace any placeholder credentials with your own key.

Request

const url = "https://api.greynoise.io/v3/community/1.1.1.1";
// Replace headers or query params with the values required by this API.
const response = await fetch(url, {
  headers: {
  "X-API-Key": "YOUR_API_KEY"
  }
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

Generated guidance based on this API's documentation, not observed by us. Treat it as a starting point and check against the provider's own error reference.

401 Unauthorized The key header is missing or the API key is incorrect.

✓ Include the key header (not Authorization) with your GreyNoise API key in every request.

"ip not found" in response GreyNoise has no data for that IP because it has not been observed scanning the internet.

✓ This is actually a useful result — it means the IP is not a known mass scanner and may deserve closer attention.

429 Rate Limited Community tier has strict rate limits (typically 50 requests per day).

✓ Cache results locally and upgrade to a paid plan if you need to check large volumes of IPs.

Metadata Score Breakdown

Estimated from metadata — endpoint not independently tested

This score is estimated from observable metadata — HTTPS support, authentication model, declared CORS, and documentation reachability — because the API requires authentication or exposes no publicly testable endpoint. The five-signal breakdown is only shown for live-tested APIs.

Metadata estimate · endpoint not independently tested

How is this scored? →