Product updates, new data sources, API improvements, and bug fixes shipped across the isMalicious platform.
Sixteen of the most-read terms now carry a long-form explanation, a worked example and where isMalicious surfaces the notion. Fourteen new terms cover lateral movement, DGA, IP and domain intelligence, and a new AI agent security category: prompt injection, tool call forgery, homoglyphs, invisible text and encoded payloads.
Added a searchable glossary of 50+ security terms covering threat intelligence, malware, network security, vulnerability management, and API security concepts.
Published a detailed breakdown of our 6-factor confidence scoring engine, 17 source reliability weights, data freshness guarantees, and false positive handling — available at /methodology.
Launched individual pages for high-severity CVEs including CVSS scores, EPSS probability, CISA KEV status, SSVC exploitation classification, and correlated IOCs. Available at /cve/[CVE-ID].
Ingestion pipeline now pulls daily from NVD, CISA KEV, GitHub Advisory Database, Exploit-DB, OSV, CERT-FR, MSRC, and VulnCheck. EPSS scores updated every 24 hours.
The /api-docs/bulk endpoint now accepts batches of up to 10,000 mixed IP, domain, and URL indicators in a single request. Responses stream via chunked transfer encoding.
Real-time tracking of ransomware group activity including victim organizations, attack timelines, and associated infrastructure IOCs. Updated hourly from 40+ group leak sites.
Internal pipeline rewrite reduced median latency for the /api-docs/streaming endpoint from 1.2s to 720ms. P99 latency is now under 2.5 seconds.
Victim-post ingestion now runs against additional public ransomware leak sites via the RansomLook and Ransomfeed feeds. Posts carry the group, the publication timestamp, and any correlated infrastructure indicators.
The /api/stix endpoint now produces STIX 2.1 bundles (previously STIX 2.0 only). Includes SRO relationships linking indicators to threat actors, malware families, and attack patterns.
Launched a daily feed of newly registered domains with age, registrar, nameserver, and isMalicious verdict for each entry. Available as CSV and JSON. Updated every 24 hours.
API keys can now be scoped to read-only access, preventing accidental use of write-capable keys in automated pipelines. Existing keys retain full access until explicitly downscoped.
The confidence engine now applies a time-decay penalty to older signals from lower-reliability sources. This reduces false positives from stale community-sourced reports.
New threat-intel tool showing full DNS record history for any domain — A, AAAA, MX, NS, TXT, and CNAME records with timestamps going back 3 years.
Webhook deliveries now retry up to 5 times with exponential backoff (1s, 2s, 4s, 8s, 16s). Failed deliveries after 5 attempts are logged and visible in the dashboard.
Two new sources integrated into the multi-source correlation engine, bringing the total to 17 threat intelligence feeds. Source reliability scores published at /methodology.