Identify IPs from known benign services and organizations that commonly cause false positives in network security and threat intelligence products. Note: Available only with enterprise plan’s Core Intelligence package.
External DocumentationTo learn more, visit the GreyNoise documentation.

​
Parameters

ParameterDescription
IP AddressThe IP address to search.

​
Example Output

{
	"ip": "192.168.1.1",
	"riot": true,
	"category": "malicious_bot",
	"name": "Mirai Botnet",
	"description": "IP address associated with Mirai botnet activity",
	"explanation": "This IP has been observed participating in DDoS attacks originating from compromised IoT devices infected with Mirai malware",
	"last_updated": "2025-02-15T14:32:45Z",
	"logo_url": "https://example.com/images/mirai_logo.png",
	"reference": "https://example.com/threat-reports/mirai-botnet",
	"trust_level": "high"
}

​
Workflow Library Example

Riot Ip Lookup with Greynoise and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop