# SiteCheck Web Intel – GreyNoise IP Noise Lookup

> SiteCheck Web Intel – GreyNoise IP Noise Lookup is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Checks whether an IPv4 address has been seen mass-scanning the internet recently (noise), is a known benign service (riot), and returns its GreyNoise classification, name, and last-seen date.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/grey-noise-noise?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-greynoise-ip-noise-lookup-8083928b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_HOa4Sj3raXZjbZU1LnlHD

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-greynoise-ip-noise-lookup-8083928b
```

Example prompt: Can you check GreyNoise to see if 185.220.101.1 has been seen mass-scanning the internet — is it classified as malicious, benign, or unknown?

## When to prefer this

Use this endpoint when you need a quick, low-cost internet-background-noise verdict on a specific IPv4 address using GreyNoise Community data. It is ideal for triaging IPs seen in server logs, firewall alerts, or honeypot captures. Prefer it over full Shodan or Censys lookups when you primarily want to know whether an IP is a mass-scanner or a known benign service rather than its open ports and services. Be aware that absence of a GreyNoise record does not confirm the IP is safe.

## Known failure modes

- IP not seen by GreyNoise returns noise=false with a message — does not mean the IP is safe
- Invalid or non-routable IPv4 address returns an error
- IPv6 addresses are not supported
- Rate limits or upstream GreyNoise Community API outages may return 5xx errors
- Missing 'ip' query parameter returns a validation error

## How this service works

GreyNoise Community lookup for an IPv4 address: whether it was seen mass-scanning the internet recently (noise), whether it is a known benign service (riot), its classification (benign, malicious, unknown), name and last-seen date. An address GreyNoise has not seen returns noise=false with a message; it is not a clean verdict.

## Output

Returns a JSON object with: noise (boolean — whether the IP was seen mass-scanning), riot (boolean — whether it is a known benign service), classification ('benign', 'malicious', or 'unknown'), name (actor or service name if identified), last_seen date, and a message. If the IP has never been observed by GreyNoise, noise=false is returned with an explanatory message — this is not a clean-bill-of-health verdict.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 185.220.101.1 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-greynoise-ip-noise-lookup-8083928b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)