{"uid":"cap_HOa4Sj3raXZjbZU1LnlHD","slug":"sitecheck-web-intel-greynoise-ip-noise-lookup-8083928b","name":"SiteCheck Web Intel – GreyNoise IP Noise Lookup","description":"GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), its classification (benign, malicious, unknown), name and last-seen date. An address GreyNoise has not seen returns noise=false with a message; it is not a clean verdict.","url":"https://api.webintel-api.workers.dev/api/security/grey-noise-noise?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 address such as 185.220.101.1 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_QbSURXjjZT-h_Dr2DGr00","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether an IPv4 address has been seen mass-scanning the internet recently (noise), is a known benign service (riot), and returns its GreyNoise classification, name, and last-seen date.","exampleAgentPrompt":"Can you check GreyNoise to see if 185.220.101.1 has been seen mass-scanning the internet — is it classified as malicious, benign, or unknown?","exampleUseCases":[{"title":"Triage suspicious inbound connection","prompt":"We just got a connection attempt from 45.33.32.156 — can you check if GreyNoise has flagged it as a mass-scanner or classifies it as malicious?"},{"title":"Verify benign crawler before allowing access","prompt":"Before I whitelist 66.249.66.1 in our firewall, can you check whether GreyNoise considers it a known benign service like a search engine crawler?"},{"title":"Investigate unknown IP in server logs","prompt":"I found 198.20.69.74 hitting our API repeatedly — look it up in GreyNoise and tell me if it's part of internet background noise, when it was last seen, and what it's classified as."}],"resultDescription":"Returns a JSON object with: noise (boolean — whether the IP was seen mass-scanning), riot (boolean — whether it is a known benign service), classification ('benign', 'malicious', or 'unknown'), name (actor or service name if identified), last_seen date, and a message. If the IP has never been observed by GreyNoise, noise=false is returned with an explanatory message — this is not a clean-bill-of-health verdict.","failureModes":["IP not seen by GreyNoise returns noise=false with a message — does not mean the IP is safe","Invalid or non-routable IPv4 address returns an error","IPv6 addresses are not supported","Rate limits or upstream GreyNoise Community API outages may return 5xx errors","Missing 'ip' query parameter returns a validation error"],"whenToPreferThis":"Use this endpoint when you need a quick, low-cost internet-background-noise verdict on a specific IPv4 address using GreyNoise Community data. It is ideal for triaging IPs seen in server logs, firewall alerts, or honeypot captures. Prefer it over full Shodan or Censys lookups when you primarily want to know whether an IP is a mass-scanner or a known benign service rather than its open ports and services. Be aware that absence of a GreyNoise record does not confirm the IP is safe.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:44:55.505Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-greynoise-ip-noise-lookup-8083928b"}