Documentation de l'API

Liveness probe for load balancers and monitoring. Returns a small JSON payload when the API process is up.

Machine-readable API description (may lag slightly behind this page; routes are defined in apps/rust-api).

High-level counts and trends from cached metrics (threat overview, categories, recent activity).

Reads sub-documents from the metrics:threats Redis JSON. Optional metric query selects one slice (same names as the Next.js /api/analytics route).

EPSS bucket distribution, top CVEs, and summary counts from CveCatalog. Query params filter results.

Time-bucketed counts by severity, KEV, and active exploit flags from CveCatalog.lastModifiedAt.

Comprehensive threat intelligence check. Supply one target via query or legacy aliases ip, domain, or hash (same semantics as query). Supports IPv4/IPv6, domain, URL, or file hash (MD5/SHA1/SHA256 hex). Response size depends on enrichment: basic, standard (default), or full. If no target is provided, the API still returns 200 with a minimal body (malicious: false, apiVersion, enrichmentLevel) — prefer validating client-side. For smaller, stable JSON use sub-endpoints (/check/reputation, etc.). Verdict semantics: malicious reflects high-confidence scanner-style signals (Google Safe Browsing, ransomware IOC matches), while blocklistHits / blocklistListed report aggregate feed matches that may include privacy or ads lists. Data Trust: responses include dataTrust for freshness, source reliability, completeness, and provider agreement, plus evidence for SOC-ready reasons, contradictory signals, and recommendedAction. OTX: With standard or full enrichment, the response may include otx — normalized AlienVault OTX data: community pulses (and optional reputationScore from indicator general). For IPs, full adds LevelBlue Labs labsReputation and a capped passive DNS summary. For domains, full adds passive DNS. For URLs (primary query is http(s)://...), OTX uses the URL indicator. For file hashes, standard/full may include pulse context from file/.../general; full may add a capped fileAnalysis excerpt. Uses the public OTX API; optional OTX_API_KEY improves rate limits. Omitted on basic or when OTX fails. Reports history: checks are not saved automatically — to keep a report, call POST /reports/save (platform API, session or API key) with the check result.

Get reputation data aggregated from the threat-intelligence feed corpus.

Get geographic location data including country, city, region, ISP, and coordinates.

Get WHOIS registration data including registrant, registrar, and dates.

Get SSL/TLS certificate information including issuer, validity, and chain.

Get known vulnerabilities associated with an IP address from CVE databases.

Proxies an observable to IntelOwl (/api/analyze_observable) when INTELOWL_URL and INTELOWL_API_KEY are configured. Results are cached in Redis (~1h). Use HEAD to probe without body. Set cache_only=true to return only cached data (404 if missing).

Same route as GET; use HEAD for connectivity checks without a response body.

Without query, or with type=stats, returns aggregated ransomware stats from cache (ransomware:stats) or computed from recent victims. With query, returns a lightweight stub for entity-oriented checks (full deep-dive uses dashboard / GET /ransomware/* routes). Optional include_ttps, include_iocs, limit are parsed for forward compatibility.

Returns azureTenant data from Redis for a domain (not supported for raw IPs).

On api.ismalicious.com this route scores an email from the signals the threat-intel backend owns directly: blocklist listings of the address itself (email feeds), the domain's threat level and disposable status from the corpus, and live DNS posture (MX, SPF, DMARC, DKIM). The score is a weighted computation with per-factor breakdown — same score bands as the full analysis.

For extended email risk analysis (breach catalog, EmailRep reputation, typosquatting patterns), call the Next.js route on the main site with the same auth pattern your app uses for dashboard API calls:

GET https://ismalicious.com/api/check/email?email=user@example.com

(Implementation: apps/web/app/api/check/email/route.ts.)

On ismalicious.com this route auto-detects crypto, email, phone, hash, URL, IP, or domain and forwards to the matching check handler.

POST https://ismalicious.com/api/analyze

Host split: not available on api.ismalicious.com (Rust). SDK clients must set webBaseUrl: 'https://ismalicious.com/api' (default in SDK) for analyze / checkEmail / checkPhone / checkCrypto; keep baseUrl for /check and other Rust routes.

Body: { "input": "..." } (optional input_type / query aliases). Auth uses the same API key or session pattern as other web API routes.

(Implementation: apps/web/app/api/analyze/route.ts.)

Phone risk analysis on the web app (heuristics + optional IPQS when configured).

GET https://ismalicious.com/api/check/phone?phone=%2B14155552671

(Implementation: apps/web/app/api/check/phone/route.ts.)

Checks BTC/ETH wallet addresses against ingested ScamSniffer and related scam indexes.

GET https://ismalicious.com/api/check/crypto?address=0x...

(Implementation: apps/web/app/api/check/crypto/route.ts.)

Returns plan label, maxEntitiesPerRequest for your subscription, and allPlans limits map. The JSON may include endpoint as /api/bulk/check (legacy string); the real URL is https://api.ismalicious.com/bulk/check. POST the same path with a JSON body to run a batch.

Request body: entities (required array of strings), optional enrichment, optional format (json default, or csv for a CSV body). Per-request entity caps by plan: FREE 10, BASIC 50, PRO 100, ENTERPRISE 500. Each result includes the same SOC evidence summary fields used by single checks: evidence, recommendedAction, analystStatus, and observedAt.

Three modes on one path. With id, the canonical single-CVE lookup: one record with CVSS, EPSS, CISA KEV status and due date, exploitation evidence and references[] (GET /cve/{id} is an alias; /check/cve, /vulnerability/{id} and /vulnerabilities/{id} do not exist). With query, a case-insensitive search over id, title and description. Without either, the most recent CVEs (trimmed to limit). Search and list return { "count", "cves": [...] }.

Returns the cve:recent Redis document as a JSON array (or object), truncated to limit.

Pass ip for full ASN/org data via ipwho.is, or asn (e.g. AS15169 or 15169) for a minimal ASN record.

Domains hosted on an IPv4 address via HackerTarget (one domain per line).

Historical reputation timeline for a domain or IP (entity), optional days window.

On-demand related AlienVault OTX pulses for a given pulse id. Requires pulseId. Returns { "related": [...] }. Uses the public OTX API (optional OTX_API_KEY improves rate limits).

limit (default 30, max 100). Optional press=true adjusts filtering (see server).

Reads ransomware:stats from Redis.

Without sector, returns all sectors. With sector, returns drill-down for that vertical. Optional press flag.

Daily sector-risk snapshots from Redis (ransomware:sector-risk:snapshots). days defaults to 30 (max 120). Optional sector filters to one vertical.

Requires sector. Enriches victims, risk level, top groups.

limit (default 50, max 100). Optional groups — comma-separated group names to filter.

Requires group — full threat-actor aggregate (TTPs, victims, etc.).

Returns the normalized list of tracked ransomware groups (cached from ransomware.live as ransomware:groups:all, ~6h TTL). limit defaults to 100 (max 500).

Returns source:statistics from Redis (success, data, timestamp). 404 if cache empty.

Requires X-License-Key with an active key from license_keys, plus X-API-KEY or session. Returns cached sources:all JSON or embedded sources.json fallback.

POST /search?keywords=<term> — scans Redis keys with pattern *{keywords}* (glob * stripped from input). Caps at 500 hits / 50 iterations. Returns raw Redis key strings in hits.

Returns default and api_roots pointing to /taxii/api-root (same for /taxii2).

Lists available collections (collections array) for this API root.

Same collection list as embedded in API root (dedicated path).

Metadata for a single collection id (e.g. malicious-domains).

Returns a STIX 2.1 bundle (identity + indicators) from Redis-backed threat data.

Authentication: X-API-KEY (Base64 apiKey:apiSecret) — Pro subscription required.

Performance: Each request examines at most a fixed number of Redis keys (currently 8,000). If your filters match rarely (e.g. a narrow time window), a page may return fewer than limit indicators even when X-TAXII-Has-More is true — call again with next until the feed is exhausted.

Date filters: If added_after or added_before is set, entities without a parseable firstSeen / lastSeen in Redis are excluded (they cannot be placed in a time window). Indicators without intel timestamps still appear in the bundle when no date query parameters are used.

Full-collection ingestion: For complete feed collection, omit both `added_after` and `added_before`. This returns the most complete dataset — including indicators without intel timestamps — and pagination with next behaves identically. Apply date filters only for incremental/windowed pulls where excluding timestamp-less indicators is acceptable.

Recommended polling cadence: once a day. The shared collections are rebuilt by a nightly reload that starts at 02:00 UTC and repopulates the entities this endpoint reads. Responses are computed live — there is no cache in front of them — so the freshness ceiling is that rebuild, not a TTL. Schedule your poll a few hours after it (06:00 UTC is a safe default; the reload's finish time is not tightly bounded) and one call picks up the whole day's new indicators.

Polling more often is permitted and simply returns the same set: added_after is matched against each indicator's intel time (firstSeen, falling back to lastSeen), which only advances when that reload runs. If you would rather notice a delayed or re-run reload without waiting a day, hourly is a sensible ceiling — that buys promptness of noticing, not fresher data. This is guidance, not a quota: no poll interval is enforced, and your plan's per-minute burst limit is the only thing that will stop you.

Exception: the org-reported-* collections are built from your own approved submissions rather than from the nightly reload, so they change as you submit. Poll those as often as your workflow needs.

Response headers:

Note: match[type] / match[id] query params are accepted for forward compatibility but are not yet applied server-side.

Batch submit up to 100 indicators. Duplicates upsert by (organization, type, value). Returns auto-approved rows.

Paginated list filtered by entityType and status.

Sets status to revoked and removes the value from the org Redis blocklist.

Plain text, one IOC per line. entityType: ips, domains, or hashes (aliases ip/domain/hash accepted).

Entry counts per entity type from Redis org blocklist metadata.

Get entry counts and last updated timestamps for all available blocklists. No authentication required.

Download a specific blocklist file.

Auth: optional — this is a public route, no API key required to try it. To unlock the full lists, authenticate with X-API-KEY: base64(apiKey:apiSecret), or Authorization: Basic with username = apiKey and password = apiSecret (for appliances that cap a single API-key field at 64 characters).

Plan Access:

•Anonymous (no credentials): 10% sample (lite version)

•FREE: 10% sample (lite version)

•BASIC and above: Full blocklist

There is no 401 or plan-restriction 403 on this route: every caller gets a file, and the served slice (lite vs full) follows the credentials presented.

Available Blocklists:

•blocklist-ips-critical.txt - Critical severity IPs

•blocklist-ips-all.txt - All malicious IPs

•blocklist-ips-c2.txt - C2 server IPs

•blocklist-ips-botnet.txt - Botnet IPs

•blocklist-domains-phishing.txt - Phishing domains

•blocklist-domains-malware.txt - Malware domains

•blocklist-domains-ransomware.txt - Ransomware domains

•blocklist-domains-all.txt - All malicious domains

Submit new threat intelligence sources to the community database.

Categories: malware, phishing, spam, scam, fraud, botnet, ransomware, c2

Returns redacted OIDC settings for the authenticated organization. Requires Enterprise plan and OWNER/ADMIN role.

Public endpoint used by the SSO login page. Returns { found, organizationId, domain } when an enabled connection matches the email domain.