API Playground
GET/api/check
⌘K
Endpoint
Params
no key · free anonymous quota
Response
— run a request to see the live JSON here
Full analysisGETidle
Spec merges Rust (
api.ismalicious.com) with Next.js scam routes on ismalicious.com/api (/analyze, phone, crypto, email). Pick the matching server in Scalar before “Try it”. Written examples also in API docs.Reference
Every endpoint you can call from this playground
41 operations across 18 groups, generated from isMalicious - Threat Intelligence API v1.2.0 — the same OpenAPI document the interactive reference above loads.
- Production server
- https://api.ismalicious.com
- Next.js web API (analyze / phone / crypto / email)
- https://ismalicious.com/api
- Auth header
- X-API-KEY
| Method | Endpoint | Purpose |
|---|---|---|
| monitoring— Watch ownership and authenticated monitoring | ||
| POST | /monitoring/claim-pending | Verified pending watches transferred, possibly partially |
| check— Threat intelligence check endpoints for IPs, domains, URLs, and file hashes | ||
| GET | /bulk/check | Bulk check limits and usage |
| POST | /bulk/check | Bulk entity check |
| GET | /check | Full Threat Analysis |
| GET | /check/certificates | Check Certificates |
| GET | /check/location | Check Geolocation |
| GET | /check/reputation | Check Reputation |
| GET | /check/stream | Report stream (SSE) |
| GET | /check/vulnerabilities | Check Vulnerabilities |
| GET | /check/whois | Check WHOIS |
| search— Search for similar malicious domains | ||
| POST | /search | Search Keywords |
| blocklist— Download blocklists and read their generation stats | ||
| GET | /blocklist/download/{filename} | Download Blocklist |
| GET | /blocklist/stats | Get Blocklist Stats |
| submit— Submit new threat intelligence sources | ||
| POST | /submit | Submit Sources |
| gate— isinjected gate: prompt-injection scanning and link reputation for AI agents (own scan meter) | ||
| GET | /gate/quota | GET /gate/quota |
| POST | /gate/scan | POST /gate/scan |
| GET | /gate/url | GET /gate/url?u= |
| platform— Dataset freshness and data-ops pipeline status | ||
| GET | /platform/data-freshness | Dataset freshness, version, and SLA status |
| GET | /platform/data-ops/pipeline | Data operations pipeline phases and last recorded run |
| cases— SOC case workspace: cases and their evidence timeline | ||
| GET | /cases | Case workspace list, wrapped as `{"cases": […]}` |
| POST | /cases | Created case |
| PATCH | /cases/{id} | Updated case |
| POST | /cases/{id}/evidence | Updated case with appended evidence |
| action-center— Prioritized SOC action queue | ||
| GET | /action-center/overview | Prioritized SOC action center overview |
| alerts— Alerting trends and metrics | ||
| GET | /alerts/trends | Opened/resolved per day plus MTTR percentiles for the signed-in scope |
| webhooks— Webhook event catalog | ||
| GET | /user/webhooks/events | Supported webhook events, signature scheme, and management path |
| briefs— Executive risk briefs | ||
| GET | /risk-brief/latest | Latest organization risk brief summary |
| trust— Trust assessment contract | ||
| GET | /trust/assessment/schema | Canonical trust assessment field contract |
| taxii— TAXII 2.1 / STIX 2.1 threat-intelligence feed (Pro and Enterprise). Never decrements the monthly request quota | ||
| GET | /taxii | TAXII discovery |
| GET | /taxii/api-root | TAXII API root |
| GET | /taxii/api-root/collections | List TAXII collections |
| GET | /taxii/api-root/collections/{collectionId} | Get a TAXII collection |
| GET | /taxii/api-root/collections/{collectionId}/objects | Get collection objects (STIX bundle) |
| stats— Public dataset statistics — no authentication, not metered | ||
| GET | /stats | Public dataset statistics |
| cve— Public CVE catalog statistics (EPSS, exploitation signals, time series) — no authentication, not metered | ||
| GET | /cve/stats/epss | CVE EPSS statistics |
| GET | /cve/stats/timeseries | CVE time series |
| Scam Intelligence— Next.js routes for analyze / email / phone / crypto (ismalicious.com/api). | ||
| POST | ismalicious.com/api/analyze | Unified analyze (auto-detect type) |
| GET | ismalicious.com/api/check/crypto | Check crypto wallet address |
| GET | ismalicious.com/api/check/email | Check email address |
| GET | ismalicious.com/api/check/phone | Check phone number risk |
| Account | ||
| POST | ismalicious.com/api/keys/instant | Get an API key instantly (email only) |
Calling one without the playground
# X-API-KEY carries Base64(apiKey:apiSecret)
curl -H "X-API-KEY: $ISMALICIOUS_KEY" \
"https://api.ismalicious.com/check?query=example.com"