greynoise_query_malicious.py

from greynoise import GreyNoise

# change API key and query
api_key = "<GN_API_KEY>"
gn_query = "last_seen:1d classification:malicious spoofable:false"

# set up api client
api_client = GreyNoise(api_key=api_key)
ip_list = []
complete = False
scroll = ""

# query gn and iterate to get all IP's to save to ip_list
while not complete:
    r = api_client.query(gn_query, scroll=scroll, size=10000)
    for i in r["data"]:
        ip_list.append(i["ip"])
    complete = r["complete"]
    scroll = r.get("scroll")

# write ip_list to txt file
f = open("./malicious_ips.txt", "a")
for i in ip_list:
    f.write("{}\n".format(i))
f.close()