API Documentation

Liveness probe for load balancers and monitoring. Returns a small JSON payload when the API process is up.

Machine-readable API description (may lag slightly behind this page; routes are defined in apps/rust-api).

High-level counts and trends from cached metrics (threat overview, categories, recent activity).

Reads sub-documents from the metrics:threats Redis JSON. Optional metric query selects one slice (same names as the Next.js /api/analytics route).

EPSS bucket distribution, top CVEs, and summary counts from CveCatalog. Query params filter results.

Time-bucketed counts by severity, KEV, and active exploit flags from CveCatalog.lastModifiedAt.

Comprehensive threat intelligence check. Supply one target via query or legacy aliases ip, domain, or hash (same semantics as query). Supports IPv4/IPv6, domain, URL, or file hash (MD5/SHA1/SHA256 hex). Response size depends on enrichment: basic, standard (default), or full. If no target is provided, the API still returns 200 with a minimal body (malicious: false, apiVersion, enrichmentLevel) — prefer validating client-side. For smaller, stable JSON use sub-endpoints (/check/reputation, etc.). Verdict semantics: malicious reflects high-confidence scanner-style signals (e.g. VirusTotal malicious/suspicious thresholds), while blocklistHits / blocklistListed report aggregate feed matches that may include privacy or ads lists. Data Trust: responses include dataTrust for freshness, source reliability, completeness, and provider agreement, plus evidence for SOC-ready reasons, contradictory signals, and recommendedAction. OTX: With standard or full enrichment, the response may include otx — normalized AlienVault OTX data: community pulses (and optional reputationScore from indicator general). For IPs, full adds LevelBlue Labs labsReputation and a capped passive DNS summary. For domains, full adds passive DNS. For URLs (primary query is http(s)://...), OTX uses the URL indicator. For file hashes, standard/full may include pulse context from file/.../general; full may add a capped fileAnalysis excerpt. Uses the public OTX API; optional OTX_API_KEY improves rate limits. Omitted on basic or when OTX fails.

Get reputation data from aggregated threat intelligence sources including VirusTotal integration.

Get geographic location data including country, city, region, ISP, and coordinates.

Get WHOIS registration data including registrant, registrar, and dates.

Get SSL/TLS certificate information including issuer, validity, and chain.

Get known vulnerabilities associated with an IP address from CVE databases.

Proxies an observable to IntelOwl (/api/analyze_observable) when INTELOWL_URL and INTELOWL_API_KEY are configured. Results are cached in Redis (~1h). Use HEAD to probe without body. Set cache_only=true to return only cached data (404 if missing).

Same route as GET; use HEAD for connectivity checks without a response body.

Without query, or with type=stats, returns aggregated ransomware stats from cache (ransomware:stats) or computed from recent victims. With query, returns a lightweight stub for entity-oriented checks (full deep-dive uses dashboard / GET /ransomware/* routes). Optional include_ttps, include_iocs, limit are parsed for forward compatibility.

Returns azureTenant data from Redis for a domain (not supported for raw IPs).

On api.ismalicious.com this route returns a small JSON stub (validated email, domain parts, placeholder risk summary) for pipeline compatibility.

For full email risk analysis (breaches, SPF/DKIM/DMARC, reputation, typosquatting, etc.), call the Next.js route on the main site with the same auth pattern your app uses for dashboard API calls:

GET https://ismalicious.com/api/check/email?email=user@example.com

(Implementation: apps/web/app/api/check/email/route.ts.)

On ismalicious.com this route auto-detects crypto, email, phone, hash, URL, IP, or domain and forwards to the matching check handler.

POST https://ismalicious.com/api/analyze

Host split: not available on api.ismalicious.com (Rust). SDK clients must set webBaseUrl: 'https://ismalicious.com/api' (default in SDK) for analyze / checkEmail / checkPhone / checkCrypto; keep baseUrl for /check and other Rust routes.

Body: { "input": "..." } (optional input_type / query aliases). Auth uses the same API key or session pattern as other web API routes.

(Implementation: apps/web/app/api/analyze/route.ts.)

Phone risk analysis on the web app (heuristics + optional IPQS when configured).

GET https://ismalicious.com/api/check/phone?phone=%2B14155552671

(Implementation: apps/web/app/api/check/phone/route.ts.)

Checks BTC/ETH wallet addresses against ingested ScamSniffer and related scam indexes.

GET https://ismalicious.com/api/check/crypto?address=0x...

(Implementation: apps/web/app/api/check/crypto/route.ts.)

Returns plan label, maxEntitiesPerRequest for your subscription, and allPlans limits map. The JSON may include endpoint as /api/bulk/check (legacy string); the real URL is https://api.ismalicious.com/bulk/check. POST the same path with a JSON body to run a batch.

Request body: entities (required array of strings), optional enrichment. Each result includes the same SOC evidence summary fields used by single checks: evidence, recommendedAction, analystStatus, and observedAt.

Without query, reads cve:recent (trimmed to limit). With query, reads cve:search:{query} from Redis. Returns { "results": [...] } (or a single value wrapped in results).

Returns the cve:recent Redis document as a JSON array (or object), truncated to limit.

Pass ip for full ASN/org data via ipwho.is, or asn (e.g. AS15169 or 15169) for a minimal ASN record.

Domains hosted on an IPv4 address via HackerTarget (one domain per line).

Historical reputation timeline for a domain or IP (entity), optional days window.

On-demand related AlienVault OTX pulses for a given pulse id. Requires pulseId. Returns { "related": [...] }. Uses the public OTX API (optional OTX_API_KEY improves rate limits).

limit (default 30, max 100). Optional press=true adjusts filtering (see server).

Reads ransomware:stats from Redis.

Without sector, returns all sectors. With sector, returns drill-down for that vertical. Optional press flag.

Daily sector-risk snapshots from Redis (ransomware:sector-risk:snapshots). days defaults to 30 (max 120). Optional sector filters to one vertical.

Requires sector. Enriches victims, risk level, top groups.

limit (default 50, max 100). Optional groups — comma-separated group names to filter.

Requires group — full threat-actor aggregate (TTPs, victims, etc.).

Returns the normalized list of tracked ransomware groups (cached from ransomware.live as ransomware:groups:all, ~6h TTL). limit defaults to 100 (max 500).

Returns source:statistics from Redis (success, data, timestamp). 404 if cache empty.

Requires X-License-Key with an active key from license_keys, plus X-API-KEY or session. Returns cached sources:all JSON or embedded sources.json fallback.

POST /search?keywords=<term> — scans Redis keys with pattern *{keywords}* (glob * stripped from input). Caps at 500 hits / 50 iterations. Returns raw Redis key strings in hits.

Returns default and api_roots pointing to /taxii/api-root (same for /taxii2).

Lists available collections (collections array) for this API root.

Same collection list as embedded in API root (dedicated path).

Metadata for a single collection id (e.g. malicious-domains).

Returns a STIX 2.1 bundle (identity + indicators) from Redis-backed threat data.

Authentication: X-API-KEY (Base64 apiKey:apiSecret) — Pro subscription required.

Performance: Each request examines at most a fixed number of Redis keys (currently 20,000). If your filters match rarely (e.g. a narrow time window), a page may return fewer than limit indicators even when X-TAXII-Has-More is true — call again with next until the feed is exhausted.

Date filters: If added_after or added_before is set, entities without a parseable firstSeen / lastSeen in Redis are excluded (they cannot be placed in a time window). Indicators without intel timestamps still appear in the bundle when no date query parameters are used.

Full-collection ingestion: For complete feed collection, omit both `added_after` and `added_before`. This returns the most complete dataset — including indicators without intel timestamps — and pagination with next behaves identically. Apply date filters only for incremental/windowed pulls where excluding timestamp-less indicators is acceptable.

Response headers:

Note: match[type] / match[id] query params are accepted for forward compatibility but are not yet applied server-side.

Batch submit up to 100 indicators. Duplicates upsert by (organization, type, value). Returns auto-approved rows.

Paginated list filtered by entityType and status.

Sets status to revoked and removes the value from the org Redis blocklist.

Plain text, one IOC per line. entityType: ips, domains, or hashes (aliases ip/domain/hash accepted).

Entry counts per entity type from Redis org blocklist metadata.

Get entry counts and last updated timestamps for all available blocklists. No authentication required.

Download a specific blocklist file.

Plan Access:

•FREE: 10% sample (lite version)

•BASIC+: Full blocklist

Available Blocklists:

•blocklist-ips-critical.txt - Critical severity IPs

•blocklist-ips-all.txt - All malicious IPs

•blocklist-ips-c2.txt - C2 server IPs

•blocklist-ips-botnet.txt - Botnet IPs

•blocklist-domains-phishing.txt - Phishing domains

•blocklist-domains-malware.txt - Malware domains

•blocklist-domains-ransomware.txt - Ransomware domains

•blocklist-domains-all.txt - All malicious domains

Submit new threat intelligence sources to the community database.

Categories: malware, phishing, spam, scam, fraud, botnet, ransomware, c2

Returns redacted OIDC settings for the authenticated organization. Requires Enterprise plan and OWNER/ADMIN role.

Public endpoint used by the SSO login page. Returns { found, organizationId, domain } when an enabled connection matches the email domain.