01 · Product name
GreyNoise
Tells you how an IP shows up in internet-wide scan traffic.
Published by GreyNoise.
In short
GreyNoise is a network threat-intelligence service. The site offers a free search and documents a community API, next to paid platform and blocklist products on the plans page. You ask about an IP address. The answer is GreyNoise’s classification of that address from what it observes on the internet. A tag is not a packet from your own network, and it does not name the operator.
Product pricing strategy
02
Free and paid
GreyNoise is free to search and paid for the platform products. The plans page separates free search from GreyNoise Platform and GreyNoise Block. A community API is documented for lookups. This listing does not invent a seat price. The plans page is the rate card, and it is what you should quote.
Utility and features
03
GreyNoise’s site describes the platform as real-time network threat intelligence, and a separate blocklist product for teams that want that data as a deny list. The plans page is where free search ends and the packaged products begin. The docs include a community API for lookups and a newer API, plus GNQL, the query language. Start with the getting-started guide if you are creating an account.
- IP context. You query an address. GreyNoise returns how it classifies that address from internet observations, which is the product’s job.
- Community API. The docs describe a community API alongside the v3 API and GNQL. Read the page for the current limits.
- Blocklists. GreyNoise Block is the packaged feed for teams that want a deny list. It is a different product from a one-off search.
The practical OSINT use is narrow. An address showed up in your logs. GreyNoise says whether it has seen that address in internet-wide activity. That is context for triage. It is not a history of the address’s owner, and it is not Shodan’s banner for the host. AbuseIPDB is the crowd-report neighbor. Censys is the host-and-certificate neighbor.
- 1
Search an address from your own logs in the free search before you buy anything.
- 2
Read the tag and the last-seen time. Write both down.
- 3
Use the community API only inside the limits the docs describe.
- 4
Open the plans page if you need the platform or a blocklist. Do not guess the price.
Caveats
04
GreyNoise classifies internet-wide scan traffic it observes. An address it has not seen is unknown to them, not safe. An address it calls noise can still be hitting you on purpose.
Tags and business rules change with the plan. A blocklist is a feed with false positives, especially on shared and cloud addresses. Do not auto-block the world from a tag you have not read. AbuseIPDB is the neighboring volunteer-report lookup, not a duplicate of this one.
Screenshots
05
Potential use cases
06
- An address scanned a service you run and you want to know if GreyNoise already tags it as common internet noise. Look it up. The output is their classification and tags, if they have seen it. A ‘benign’ or ‘unknown’ tag is their label, not a clearance. Pivot to AbuseIPDB for volunteer reports, which are a different dataset. Your logs remain the primary source.
- You need to separate a one-off from a scanner they have watched across the internet. Read the tag and the last-seen time the product shows. The output is that context for the address. It does not name a person. Do not ignore an intrusion because the IP is ‘noise.’ Noise can still be unwanted on your service.
- A documented blocklist from GreyNoise is an input to a control you already operate. The output is those indicators in your control, with the source and the date named. Free and paid access differ. Confirm the current split on the vendor site. This listing does not invent the quota. Shodan answers a banner question. GreyNoise answers a ‘have we seen this scanner’ question.
Hard cases
The case where the first result is easy to over-read.
Noise on one port, intrusion on another
GreyNoise says the address is a known scanner. Your logs show a successful login from it an hour later. The tag does not explain the login. Treat the scan reputation and the authentication event as two facts. Pivot the address to your own identity logs. Do not close the incident because a feed said the IP was background radiation.
Questions
Is GreyNoise free?
Search is free, and there is a documented community API. The platform and blocklist products are paid. See the plans page.
Does GreyNoise show who owns an IP?
No. It classifies observed behavior. Ownership, a banner, and a user report are other tools.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
GreyNoise
https://www.greynoise.io/Pricing
GreyNoise plans
https://www.greynoise.io/plansDocumentation
GreyNoise community API
https://docs.greynoise.io/docs/using-the-greynoise-community-api