IP Data
The IP address of the scanning device IP
A list of cves the device has been assigned over the past 90 days
Whether the device has been categorized as unknown, benign, or malicious
The date the device was first observed by GreyNoise
The date the device was most recently observed by GreyNoise
The benign actor the device has been associated with, such as Shodan, GoogleBot, BinaryEdge, etc
A list of tags the device has been assigned over the past 90 days
This IP address has been opportunistically scanning the Internet, however has failed to complete a full TCP connection. Any reported activity could be spoofed.
This IP is associated with a VPN service. Activity, malicious or otherwise, should not be attributed to the VPN service provider.
The VPN service the IP is associated with
The IP has been associated with known bot activity
Metadata
Whether the device is a business, isp, or hosting provider
The full name of the country the device is geographically located in
The two-character country code of the country the device is geographically located in
The city the device is geographically located in
The full name or country code where GreyNoise sensor is physically located
The two-character country code where GreyNoise sensor is physically located
A boolean parameter that filters source country IPs that have only been observed in a single destination country
The organization that owns the network that the IP address belongs to
The region the device is geographically located in
The reverse DNS record for the IP
The autonomous system the IP address belongs to
Whether or not the device is a known Tor exit node
Raw Data
The port number(s) the devices has been observed scanning
The protocol of the port the device has been observed scanning
Any HTTP paths the device has been observed crawling the Internet for
Any HTTP user-agents the device has been observed using while crawling the Internet
The JA3 TLS/SSL fingerprint
The corresponding TCP port for the given JA3 fingerprint
The HASSH fingerprint
The corresponding TCP port for the given HASSH fingerprint