https://cybertoolchain.io/tools/ismalicious New releases and features in isMalicious, tracked by The Cyber Toolchain. en Mon, 02 Nov 2026 07:59:54 GMT https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Mon, 02 Nov 2026 07:59:54 GMT API surface changed: +2 endpoints, 11 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /cve/attribution⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /cve/resolve Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Mon, 26 Oct 2026 13:50:23 GMT API surface changed: +26 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new endpoints `DELETE /surveillance/components/{id}`, `PATCH /surveillance/components/{id}`, and `POST /surveillance/sources/{id}/components` for managing surveillance components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new endpoints `DELETE /surveillance/sources/{id}`, `GET /surveillance/sources`, `GET /surveillance/sources/{id}`, `PATCH /surveillance/sources/{id}`, `POST /surveillance/sources`, and `POST /surveillance/sources/{id}/refresh` for managing surveillance sources. • Adds new endpoints `GET /cve/exploited`, `GET /cve/{id}/affected`, `GET /cve/{id}/indicators`, `GET /edl/cve/{id}`, and `GET /edl/exploited-cves` for CVE exploitation and indicator intelligence. • Adds new endpoints `GET /surveillance/catalog/products`, `GET /surveillance/exposure`, `GET /surveillance/quota`, `POST /surveillance/analyze`, and `POST /surveillance/preview` for surveillance catalog, exposure, quota, analysis, and preview. • Adds new endpoints `GET /surveillance/findings`, `GET /surveillance/findings/{id}`, `PATCH /surveillance/findings/{id}`, and `POST /surveillance/findings/bulk-status` for managing surveillance findings. • Adds new endpoints `GET /surveillance/policy`, `POST /surveillance/policy/test`, and `PUT /surveillance/policy` for managing surveillance policy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Fri, 16 Oct 2026 08:15:03 GMT isMalicious adds CVE intelligence pages, STIX/TAXII 2.1 feeds, DNS history, ransomware victim tracking, and webhook retry logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands ransomware victim post coverage via RansomLook and Ransomfeed, each entry carrying group, publication time, and correlated indicators. • Adds a searchable glossary of 50+ terms spanning threat intelligence, malware, network, vulnerability, and API security, including an AI agent security category. • Publishes long-form explanations and worked examples for 16 top terms, plus 14 new terms. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Thu, 15 Oct 2026 07:42:34 GMT isMalicious ships bulk IOC API, STIX/TAXII 2.1 feeds, NRD feed, DNS history, ransomware tracker, and CVE intelligence pages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST /api-docs/bulk` endpoint accepting mixed IP, domain, and URL batches in a single request, up to 500 indicators per request; responses stream via chunked transfer encoding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds TAXII 2.1 collections serving STIX 2.1 objects for OpenCTI, MISP, and Sentinel; included in Pro and Enterprise plans. • Adds a daily NRD (newly registered domain) feed with age, registrar, nameserver, and isMalicious verdict, available in CSV and JSON. • Adds webhook delivery retry and status logging: failed deliveries are retried once and each attempt is logged with its HTTP status code in the dashboard. • Adds programmatic CVE intelligence pages at `/cve/[CVE-ID]` with CVSS, EPSS, CISA KEV status, SSVC exploitation data, and correlated IOCs. • Adds a DNS history lookup tool returning A, AAAA, MX, NS, TXT, and CNAME records timestamped over 3 years for any domain. • Adds AlienVault OTX and Emerging Threats as correlation engine sources, bringing the total to 17 feeds; source weights published at `/methodology`. • Publishes a 6-factor confidence formula, source weights, freshness limits, and false-positive handling at `/methodology`. • Reduces streaming threat feed median latency by 40%, from 1.2 s to 720 ms; p99 now under 2.5 s. • Improves confidence scoring to discount older signals from lower-reliability sources over time, reducing false positives from stale community reports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Mon, 05 Oct 2026 08:05:31 GMT Breaking changes: • POST /search: param keywords (query) added [required]; param keywords (path) removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Sun, 04 Oct 2026 13:54:24 GMT Breaking changes: • POST /search: param keywords (query) added [required]; param keywords (path) removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Sat, 03 Oct 2026 13:03:38 GMT API surface changed: +8 endpoints, 8 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /pwned-passwords/range/{prefix}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /taxii/api-root/collections/{collectionId}/manifest • New endpoint GET /taxii/api-root/collections/{collectionId}/objects/{objectId} • New endpoint GET /taxii/api-root/collections/{collectionId}/objects/{objectId}/versions • New endpoint GET /taxii/api-root/status/{statusId} • New endpoint POST /check/password • New endpoint POST /mail/scan • New endpoint POST /taxii/api-root/collections/{collectionId}/objects • GET /check: param country (query) added • GET /taxii/api-root/collections/{collectionId}/objects: param match[id] (query) added; param match[spec_version] (query) added; param match[type] (query) added; param match[version] (query) added Breaking changes: • POST /search: param keywords (query) added [required]; param keywords (path) removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Tue, 29 Sep 2026 14:32:46 GMT API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /ransomware/groups: param sort (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Fri, 25 Sep 2026 13:22:25 GMT API surface changed: +14 endpoints, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /check/tenant⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /cve • New endpoint GET /cve/recent • New endpoint GET /cve/{id} • New endpoint GET /ransomware/feed • New endpoint GET /ransomware/group-profile • New endpoint GET /ransomware/groups • New endpoint GET /ransomware/live-quota • New endpoint GET /ransomware/press • New endpoint GET /ransomware/sector-risk • New endpoint GET /ransomware/sector-risk/history • New endpoint GET /ransomware/sector-victims • New endpoint GET /ransomware/stats • New endpoint POST /indicator-context Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Mon, 21 Sep 2026 14:37:20 GMT API surface changed: 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /taxii/api-root/collections/{collectionId}/objects: param max_score (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Sun, 13 Sep 2026 14:48:48 GMT API surface changed: +1 endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint POST /monitoring/claim-pending⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Thu, 10 Sep 2026 14:47:41 GMT API surface changed: +1 endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint POST /monitoring/claim-pending⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Fri, 04 Sep 2026 07:49:46 GMT API surface changed: +9 endpoints • New endpoint GET /check/stream • New endpoint GET /cve/stats/epss • New endpoint GET /cve/stats/timeseries • New endpoint GET /stats • New endpoint GET /taxii • New endpoint GET /taxii/api-root • New endpoint GET /taxii/api-root/collections • New endpoint GET /taxii/api-root/collections/{collectionId} • New endpoint GET /taxii/api-root/collections/{collectionId}/objects Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Mon, 31 Aug 2026 20:50:31 GMT API surface changed: 25 modified • GET /action-center/overview: response schema changed • GET /alerts/trends: response schema changed • GET /blocklist/download/{filename}: response schema changed • GET /blocklist/stats: response schema changed • GET /bulk/check: response schema changed • GET /cases: response schema changed • GET /gate/url: response schema changed • GET /platform/data-freshness: response schema changed • GET /platform/data-ops/pipeline: response schema changed • GET /risk-brief/latest: response schema changed • GET /trust/assessment/schema: response schema changed • GET /user/webhooks/events: response schema changed • PATCH /cases/{id}: response schema changed • POST /bulk/check: response schema changed • POST /cases: request body changed; response schema changed • POST /cases/{id}/evidence: response schema changed • POST /gate/scan: response schema changed • POST /search: response schema changed • POST /submit: request body changed; response schema changed Breaking changes: • GET /check: param domain (query) added; param enrichment (query) added; param hash (query) added; param ip (query) added; param query (query) added; param enrichment (path) removed; param query (path) removed; param track_reports (path) removed; response schema changed • GET /check/certificates: param query (query) added; param enrichment (path) removed; param query (path) removed; param track_reports (path) removed; response schema changed • GET /check/location: param query (query) added; param enrichment (path) removed; param query (path) removed; param track_reports (path) removed; response schema changed • GET /check/reputation: param query (query) added; param enrichment (path) removed; param query (path) removed; param track_reports (path) removed; response schema changed • GET /check/vulnerabilities: param query (query) added; param enrichment (path) removed; param query (path) removed; param track_reports (path) removed; response schema changed • GET /check/whois: param query (query) added; param enrichment (path) removed; param query (path) removed; param track_reports (path) removed; response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/openapi.json https://ismalicious.com/openapi.json Fri, 28 Aug 2026 19:46:33 GMT API surface changed: +3 endpoints • New endpoint GET /gate/quota • New endpoint GET /gate/url • New endpoint POST /gate/scan Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Mon, 20 Apr 2026 00:00:00 GMT isMalicious expands CVE database to 50K+ entries with daily ingestion from NVD and CISA KEV • CVE database expanded to 50K+ entries Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Mon, 20 Apr 2026 00:00:00 GMT Launched programmatic CVE intelligence pages at /cve/<CVE-ID> with CVSS, EPSS, KEV, SSVC, and IOCs • Adds new endpoint `/cve/[CVE-ID]` returning structured intelligence for high-severity CVEs including CVSS scores, EPSS probability, CISA KEV status, SSVC exploitation classification, and correlated IOCs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Wed, 15 Apr 2026 00:00:00 GMT Adds /api-docs/bulk endpoint accepting up to 10,000 mixed indicators per request • `/api-docs/bulk` endpoint now accepts batches of up to 10,000 mixed IP, domain, and URL indicators in a single request Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Wed, 15 Apr 2026 00:00:00 GMT isMalicious /api-docs/bulk now accepts mixed IP, domain, URL batches in one request • The /api-docs/bulk endpoint accepts mixed IP, domain, and URL batches, up to 500 indicators per request depending on plan, and streams responses via chunked transfer encoding. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Fri, 10 Apr 2026 00:00:00 GMT Launch of the isMalicious ransomware victim tracker service. • New service offering real-time tracking of ransomware group activity, including victims, timelines, and infrastructure IOCs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Wed, 01 Apr 2026 00:00:00 GMT isMalicious April 2026 adds glossary, methodology page, CVE intelligence pages, bulk indicator checks and ransomware tracker • Adds a searchable glossary of 50+ security terms at /glossary for threat intelligence, malware, network security, vulnerability management, and API security concepts. • Publishes a methodology breakdown page at /methodology detailing the 6-factor confidence scoring engine, 17 source reliability weights, data freshness guarantees, and false positive handling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Sat, 28 Mar 2026 00:00:00 GMT Expands ransomware leak-site coverage by ingesting RansomLook and Ransomfeed feeds for victim-post ingestion. • Adds support for `RansomLook` feed in victim-post ingestion • Adds support for `Ransomfeed` feed in victim-post ingestion Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Fri, 20 Mar 2026 00:00:00 GMT The /api/stix endpoint now outputs STIX 2.1 bundles, including SRO relationships for indicators, threat actors, malware families, and attack patterns. • The /api/stix endpoint now outputs STIX 2.1 bundles, including SRO relationships for indicators, threat actors, malware families, and attack patterns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Sun, 15 Mar 2026 00:00:00 GMT isMalicious introduces a daily NRD feed providing domain metadata and risk verdicts in CSV and JSON formats. • isMalicious introduces a daily NRD feed providing domain metadata and risk verdicts in CSV and JSON formats. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Tue, 10 Mar 2026 00:00:00 GMT isMalicious now allows API keys scoped to read-only access for safer pipeline usage. • isMalicious now allows API keys scoped to read-only access for safer pipeline usage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Sun, 01 Mar 2026 00:00:00 GMT isMalicious introduces NRD feed, STIX 2.1 export API, and read-only API key scoping in March 2026 release. • `/api/stix` endpoint now returns STIX 2.1 bundles with SRO relationships linking indicators to threat actors, malware families, and attack patterns. • Launched a daily NRD (newly registered domain) feed available as CSV and JSON, providing age, registrar, nameserver, and isMalicious verdict for each entry. • Added `read-only` API key scope to prevent accidental use of write-capable keys in automated pipelines. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Fri, 20 Feb 2026 00:00:00 GMT Introduces DNS history lookup for A, AAAA, MX, NS, TXT, and CNAME records with 3-year backfill. • Adds DNS history lookup capability supporting full record types (A, AAAA, MX, NS, TXT, CNAME) with timestamps up to 3 years in the past • Provides a new threat-intelligence endpoint for retrieving historical domain resolution data Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Tue, 10 Feb 2026 00:00:00 GMT isMalicious adds webhook delivery retry with exponential backoff for failed deliveries. • Failed deliveries after 5 attempts are logged and visible in the dashboard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Sun, 01 Feb 2026 00:00:00 GMT New DNS history lookup and webhook retry logic in February 2026 release • Adds DNS history lookup showing A, AAAA, MX, NS, TXT, and CNAME records with timestamps going back 3 years. • Adds webhook delivery retry with exponential backoff (up to 5 attempts) for failed deliveries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Wed, 28 Jan 2026 00:00:00 GMT Adds AlienVault OTX and Emerging Threats to the correlation engine (17 feeds total) • Integrates AlienVault OTX as a new threat intelligence source in the multi-source correlation engine. • Integrates Emerging Threats as a new threat intelligence source in the multi-source correlation engine, bringing the total feed count to 17. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious https://ismalicious.com/changelog https://ismalicious.com/changelog Thu, 01 Jan 2026 00:00:00 GMT AlienVault OTX and Emerging Threats added as new threat intel feeds in January 2026 release. • Adds AlienVault OTX to the multi-source correlation engine • Adds Emerging Threats to the multi-source correlation engine Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ismalicious