GreyNoise Community API

Use in your agent

Query a GreyNoise Community IP into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.

Access

• No account or key for up to 10 IPv4 lookups per day.
• A free account using a business email supplies an API key and raises the combined Community API and Visualizer allowance to 50 searches per week.

Request

curl 'https://api.greynoise.io/v3/community/8.8.8.8'

Format

JSON for one IPv4 address with noise and RIOT booleans plus classification, organization name, last-seen date, link and message when available.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

"""GreyNoise Community lookup for one IPv4 address -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://api.greynoise.io/v3/community/8.8.8.8"
r = requests.get(URL, timeout=60)
if r.status_code not in (200, 404):
    r.raise_for_status()
payload = r.json()
df = pd.DataFrame([payload])
df["last_seen"] = pd.to_datetime(df.get("last_seen"), errors="coerce", utc=True)
df.to_parquet("greynoise_community.parquet", index=False)
print(payload["ip"], "noise", payload.get("noise"), "riot", payload.get("riot"), payload.get("message"))

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 8.8.8.8 noise False riot False IP not observed scanning the internet.

Limits

• Rate limit: 10 IP lookups per day without authentication.
• Free-account limit: 50 searches per week combined between the Community API and Visualizer.
• Only one valid routable IPv4 address is accepted per request.

Quirks

• A 404 response is a structured negative observation, so retain its JSON instead of treating it as a failed ingestion.
• noise means the address was observed scanning the Internet in the last 90 days; it is not by itself a malicious-intent finding.
• Free responses omit much of the context available in paid GreyNoise products, and fields such as classification or last_seen may be absent.

Terms and attribution

• Free-product use is licensed for internal business or non-commercial purposes and is revocable.
• The provider terms prohibit redistribution, unauthorized derived products, and using GreyNoise data to train or improve AI systems.

Sources

• https://docs.greynoise.io/docs/using-the-greynoise-community-api.md: “Available to unauthenticated users with a limited number of lookups per day”
• https://docs.greynoise.io/docs/using-the-greynoise-community-api.md: “Currently, community / free-level accounts are able to do 50 searches per week.”
• https://docs.greynoise.io/reference/getcommunityip.md: “The IP address submitted is not a valid routable IPv4 address.”
• https://www.greynoise.io/terms: “such use is limited to your internal business purposes or noncommercial purposes such as academic research, if applicable.”