Check IOC
IP, domain, or URL → malicious flag, score, categories, sources.
Integration
n8n Community Node: IOC lookup inside an existing workflow
Add a Check indicator node, attach your isMalicious API credential and enrich each item.
No credit card required · Free API key
Capabilities
Key features at a glance.
No extra deps
Uses n8n helpers.httpRequest so the package can be verified.
Same /check API
The same lookup used by scripts and the Cortex analyzer.
Self-hosted install
Community nodes panel, or npm install n8n-nodes-ismalicious.
Applications
Use cases to evaluate first.
Alert enrichment
Take an IP from a webhook or SIEM poll and attach an isMalicious report before Slack/email.
Allow/deny gates
Branch the workflow on malicious=true without a custom HTTP node.
FAQ
Frequently asked questions.
Where is the node published?
The source is public at github.com/hexablob/n8n-nodes-ismalicious (MIT). The npm package name is n8n-nodes-ismalicious; verification goes through the n8n Creator Portal.
What does the node do?
One operation: Check indicator. It calls GET /check with X-API-KEY and returns the JSON report. No webhook trigger in v0.1.0.
Does it add n8n dependencies?
No runtime dependencies. Verified community nodes cannot ship extra packages; the node uses n8n helpers.httpRequest.
Explore
Related tools and pages.
Test it with your own indicators.
The free plan includes website lookups with no monthly cap and 250 API requests a month. Check the sources and limits, then connect the API.
No credit card required · Free API key