isMalicious — API

isMalicious - Threat Intelligence APIv1.2.0 Read the vendor's spec ↗

58 endpoints
11 versions archived since Jul 23, 2026
Last checked Oct 20, 2026

Official isMalicious threat intelligence API for domain, IP, and URL reputation checking.

first call

$ curl "https://api.ismalicious.com/cve" \
  -H "X-API-KEY: $API_KEY"

Set $API_KEY first, then paste.

Base URL: https://api.ismalicious.com
Authenticate: API key in the X-API-KEY header Base64 encoded apiKey:apiSecret.

3 other schemes

Bearer token in the Authorization header
HTTP basic: username and password
API key in the __Secure-authjs.session-token cookie
Shape: GET46
POST11
PATCH1

What it covers

Check 13 Threat intelligence check endpoints for IPs, domains, URLs, and file hashes
Taxii 10 TAXII 2.1 / STIX 2.1 threat-intelligence feed (Pro and Enterprise).
Ransomware 9 Ransomware intelligence from the cached ransomware.live datasets: victims, groups, sectors, press.
Cve 5 CVE catalog: lookup by id, search and recent list (authenticated, one request each) and public statistics (EPSS, exploitation signals, time series — no authentication, not metered)
Cases 4 SOC case workspace: cases and their evidence timeline
Gate 3 isinjected gate: prompt-injection scanning and link reputation for AI agents (own scan meter)
Blocklist 2 Download blocklists and read their generation stats
Platform 2 Dataset freshness and data-ops pipeline status
Action Center 1 Prioritized SOC action queue
Alerts 1 Alerting trends and metrics
Briefs 1 Executive risk briefs
Mail 1 Inbound-message scan: what a mail's structure and the dataset say about it (gate scan meter, one unit per message)

6 more areas

Monitoring 1 Watch ownership and authenticated monitoring
Search 1 Search for similar malicious domains
Stats 1 Public dataset statistics — no authentication, not metered
Submit 1 Submit new threat intelligence sources
Trust 1 Trust assessment contract
Webhooks 1 Webhook event catalog

Open an endpoint for a runnable command, its inputs and what it returns.

Check 13

GET /bulk/check Bulk check limits and usage

Loading…
GET /check Full Threat Analysis

Loading…
GET /check/certificates Check Certificates

Loading…
GET /check/location Check Geolocation

Loading…
GET /check/reputation Check Reputation

Loading…
GET /check/stream Report stream (SSE)

Loading…
GET /check/tenant Microsoft 365 tenant

Loading…
GET /check/vulnerabilities Check Vulnerabilities

Loading…
GET /check/whois Check WHOIS

Loading…
GET /pwned-passwords/range/{prefix} k-anonymity lookup in Have I Been Pwned's Pwned Passwords corpus.

Loading…
POST /bulk/check Bulk entity check

Loading…
POST /check/password Breach exposure of a password, checked as an indicator.

Loading…
POST /indicator-context

Loading…

Taxii 10

GET /taxii TAXII discovery

Loading…
GET /taxii/api-root TAXII API root

Loading…
GET /taxii/api-root/collections List TAXII collections

Loading…
GET /taxii/api-root/collections/{collectionId} Get a TAXII collection

Loading…
GET /taxii/api-root/collections/{collectionId}/manifest Get object manifests

Loading…
GET /taxii/api-root/collections/{collectionId}/objects Get collection objects

Loading…
GET /taxii/api-root/collections/{collectionId}/objects/{objectId} Get an object

Loading…
GET /taxii/api-root/collections/{collectionId}/objects/{objectId}/versions Get object versions

Loading…
GET /taxii/api-root/status/{statusId} Get status

Loading…
POST /taxii/api-root/collections/{collectionId}/objects Add objects (refused)

Loading…

Ransomware 9

GET /ransomware/feed Recent ransomware victims

Loading…
GET /ransomware/group-profile Ransomware group profile

Loading…
GET /ransomware/groups Ransomware groups

Loading…
GET /ransomware/live-quota ransomware.live call budget

Loading…
GET /ransomware/press Ransomware press

Loading…
GET /ransomware/sector-risk Sector risk

Loading…
GET /ransomware/sector-risk/history Sector risk history

Loading…
GET /ransomware/sector-victims Sector victims

Loading…
GET /ransomware/stats Ransomware statistics

Loading…

Cve 5

GET /cve CVE lookup, search and recent list

Loading…
GET /cve/recent Recent CVEs (bare array)

Loading…
GET /cve/stats/epss CVE EPSS statistics

Loading…
GET /cve/stats/timeseries CVE time series

Loading…
GET /cve/{id} CVE by id (path form)

Loading…

Cases 4

GET /cases

Loading…
PATCH /cases/{id}

Loading…
POST /cases

Loading…
POST /cases/{id}/evidence

Loading…

Gate 3

GET /gate/quota GET /gate/quota

Loading…
GET /gate/url GET /gate/url?u=

Loading…
POST /gate/scan POST /gate/scan

Loading…

Blocklist 2

GET /blocklist/download/{filename} Download Blocklist

Loading…
GET /blocklist/stats Get Blocklist Stats

Loading…

Platform 2

GET /platform/data-freshness

Loading…
GET /platform/data-ops/pipeline

Loading…

Action Center 1

GET /action-center/overview

Loading…

Alerts 1

GET /alerts/trends

Loading…

Briefs 1

GET /risk-brief/latest

Loading…

Mail 1

POST /mail/scan POST /mail/scan

Loading…

Monitoring 1

POST /monitoring/claim-pending

Loading…

Search 1

POST /search Search Keywords

Loading…

Stats 1

GET /stats Public dataset statistics

Loading…

Submit 1

POST /submit Submit Sources

Loading…

Trust 1

GET /trust/assessment/schema

Loading…

Webhooks 1

GET /user/webhooks/events

Loading…

Change log

2026-10-05
- +GET /pwned-passwords/range/{prefix}
- +GET /taxii/api-root/collections/{collectionId}/manifest
- +GET /taxii/api-root/collections/{collectionId}/objects/{objectId}
- +GET /taxii/api-root/collections/{collectionId}/objects/{objectId}/versions
- +GET /taxii/api-root/status/{statusId}
- +POST /check/password
- +POST /mail/scan
- +POST /taxii/api-root/collections/{collectionId}/objects
2026-09-26
- +GET /check/tenant
- +GET /cve
- +GET /cve/recent
- +GET /cve/{id}
- +GET /ransomware/feed
- +GET /ransomware/group-profile
- +GET /ransomware/groups
- +GET /ransomware/live-quota
- +GET /ransomware/press
- +GET /ransomware/sector-risk
- +GET /ransomware/sector-risk/history
- +GET /ransomware/sector-victims
- +GET /ransomware/stats
- +POST /indicator-context
2026-09-10
- +POST /monitoring/claim-pending
2026-09-04
- +GET /check/stream
- +GET /cve/stats/epss
- +GET /cve/stats/timeseries
- +GET /stats
- +GET /taxii
- +GET /taxii/api-root
- +GET /taxii/api-root/collections
- +GET /taxii/api-root/collections/{collectionId}
- +GET /taxii/api-root/collections/{collectionId}/objects
2026-08-28
- +GET /gate/quota
- +GET /gate/url
- +POST /gate/scan