Mixed types
Domains, IPs, and URLs in the same entities array.
API & Tools
Bulk API in one POST
POST JSON batches of domains, IPs, and URLs to https://api.ismalicious.com/bulk/check. One synchronous response with per-entity verdicts, confidence, and categories.
No credit card required · Free API key
Request
One POST, one result per entity.
curl -X POST "https://api.ismalicious.com/bulk/check" \
-H "X-API-KEY: YOUR_BASE64_CREDENTIALS" \
-H "Content-Type: application/json" \
-d '{"entities":["example.com","8.8.8.8"],"enrichment":"full"}'200 OK · response excerpt
{
"success": true,
"total": 2,
"processed": 2,
"results": [
{
"entity": "example.com",
"type": "domain",
"isMalicious": false,
"confidence": 12,
"sources": 3,
"categories": []
},
{
"entity": "8.8.8.8",
"type": "ip",
"isMalicious": false,
"confidence": 0.05,
"sources": 1,
"categories": []
}
],
"processingTimeMs": 210
}- Entities/Request
- 10–500
- Basic · per request
- 50
- Pro · per request
- 100
- Enterprise · per request
- 500
Capabilities
Key features at a glance.
Plan limits
GET /bulk/check returns your max batch size and usage.
Same auth
X-API-KEY (Base64 apiKey:apiSecret) like /check.
Applications
Use cases to evaluate first.
Log Enrichment
Enrich SIEM logs with threat data in batch.
List Validation
Validate blocklists and IOC lists against our intel.
Email Processing
Check all URLs and domains from email batches.
Threat Hunting
Analyze large sets of IOCs during investigations.
In depth
Worth knowing before you start.
When to use bulk vs single check
Use bulk for dashboards, CSV validation, or moderate-sized lists. For deep per-entity reports or streaming progress, use GET /check or SSE /check/stream.
FAQ
Frequently asked questions.
How many items can I submit per request?
Free: 10 entities; Basic: 50; Pro: 100; Enterprise: 500. Exceeding the limit returns an error, so split larger lists into multiple requests or upgrade.
What input formats are supported?
JSON only: an entities array of strings (domains, IPs, URLs).
Is processing synchronous?
Yes. The HTTP response includes every entity result in one JSON payload.
Can I get full enrichment per entity?
Optional enrichment in the body influences how deeply each entity is analyzed (same idea as GET /check).
Explore
Related tools and pages.
Research
Related articles from the research blog.
Blog post
Bulk IP and Domain Lookups: Designing Indicator Enrichment That Survives Real Volume
One incident produces hundreds of indicators, and per-indicator lookups are where triage stalls. Here is how to build a batch enrichment pipeline that respects quotas, deduplicates properly, and fails gracefully.
Read more
Blog post
API Integration for Threat Intelligence: Automate Your Security
Discover how integrating threat intelligence APIs can transform your security infrastructure. Learn best practices for automated threat detection, continuous monitoring, and documented integration with your existing systems.
Read more
Blog post
Hash Reputation at Scale: Building Detection Rules That Survive Real Networks
Move beyond one-off hash blocks: design reputation pipelines, reduce false positives, and integrate file intelligence with IP and domain context for production-ready detection engineering.
Read moreTest it with your own indicators.
The free plan includes website lookups with no monthly cap and 250 API requests a month. Check the sources and limits, then connect the API.
No credit card required · Free API key