# isMalicious

> Real-time threat intelligence API: malicious IP/domain/URL detection, ransomware tracking, CVE intelligence, and indexed threat records. Trusted by security professionals, SOC teams, and developers worldwide.

## Product

- [Homepage](https://ismalicious.com/): isMalicious threat intelligence platform overview
- [Pricing](https://ismalicious.com/pricing): Free (250 API requests a month, no credit card), Pro, and Enterprise plans
- [API Overview](https://ismalicious.com/api): REST API for threat intelligence lookups
- [API Documentation](https://ismalicious.com/api-docs): Full API reference with endpoints, authentication, and rate limits
- [Lookup API](https://ismalicious.com/api-docs/lookup): Single IP/domain/URL reputation lookup
- [Bulk API](https://ismalicious.com/api-docs/bulk): Batch lookup, up to 500 indicators per request depending on the plan
- [Check stream (SSE)](https://ismalicious.com/api-docs/streaming): GET /check/stream, one check whose results arrive phase by phase as Server-Sent Events
- [Webhooks](https://ismalicious.com/api-docs/webhooks): Push-based threat notifications
- [SDKs](https://ismalicious.com/api-docs/sdks): Official TypeScript SDK; other languages use REST or OpenAPI
- [MCP server](https://www.npmjs.com/package/@ismalicious/mcp-server): `npx -y @ismalicious/mcp-server` — tools check_indicator (verdict, risk, sources, recommended action for an IP/domain/URL/hash), get_cve and recent_cves (CVSS, EPSS, KEV), scan_before_use and check_url (prompt-injection gate), scan_email (phishing and malware scan of one email message: verdict, recommended action, reasons; one scan per message), check_password_exposure (is a password or its SHA-1/NTLM hash in breach dumps; hashed locally, k-anonymity), bootstrap_key (free key from an email). Registry: com.ismalicious/mcp-server. Setup: https://ismalicious.com/prompt-injection-scanner

## High-Intent Evaluation Hubs

- [Threat Intelligence API](https://ismalicious.com/api): REST API overview for IP, domain, URL, and hash reputation workflows
- [Pricing](https://ismalicious.com/pricing): Free API key, Pro, and Enterprise plan details
- [Threat Database](https://ismalicious.com/database): Threat record coverage, freshness, and lookup experience
- [CVE Intelligence](https://ismalicious.com/security/cve-search): Live CVE search with EPSS, KEV, MSRC, GHSA, Exploit-DB, and Nuclei enrichment
- [Ransomware Intelligence](https://ismalicious.com/ransomware): Ransomware group tracking, victims, and sector risk data
- [STIX/TAXII Feeds](https://ismalicious.com/data/stix-taxii): Standards-based threat intelligence sharing for CTI platforms
- [Vendor Comparisons](https://ismalicious.com/vs): Comparison pages for security teams evaluating alternatives
- [Resources](https://ismalicious.com/resources): Documentation, playbooks, glossary, research, status, and contact paths
- [Glossary](https://ismalicious.com/glossary): Definitions of threat intelligence, malware, network, vulnerability, API and AI agent security terms, each with an example and where isMalicious surfaces it

## Threat Intelligence Tools

- [Domain Lookup](https://ismalicious.com/threat-intel/domain): Check domain reputation across configured intelligence sources
- [IP Lookup](https://ismalicious.com/threat-intel/ip): IP reputation and geolocation
- [URL Scanner](https://ismalicious.com/threat-intel/url-scanner): Scan URLs for phishing, malware, and redirects
- [File Hash Reputation](https://ismalicious.com/threat-intel/file-hash): Check MD5, SHA1, and SHA256 reputation for malware and IOC enrichment
- [WHOIS Lookup](https://ismalicious.com/threat-intel/whois): Domain registration and ownership data
- [DNS History](https://ismalicious.com/threat-intel/dns-history): Historical DNS record changes
- [Reverse IP](https://ismalicious.com/threat-intel/reverse-ip): Find all domains on an IP address
- [Subdomains](https://ismalicious.com/threat-intel/subdomains): Enumerate subdomains for a domain
- [ASN Lookup](https://ismalicious.com/threat-intel/asn): Autonomous System Number details and reputation
- [Domain Age](https://ismalicious.com/threat-intel/domain-age): Domain registration age as a risk indicator
- [Bulk Check](https://ismalicious.com/threat-intel/bulk-check): Check multiple indicators simultaneously
- [Password Breach Checker](https://ismalicious.com/threat-intel/password): Whether a password, or its SHA-1 or NTLM hash, is in known breach dumps (Have I Been Pwned's Pwned Passwords, 2B+ hashes) and how often. k-anonymity: only 5 hash characters are sent. API: POST /check/password, GET /pwned-passwords/range/{prefix}

## Security Intelligence

- [Ransomware Database](https://ismalicious.com/ransomware): Live ransomware group tracking and victim data
- [CVE Search](https://ismalicious.com/security/cve-search): Search CVEs by ID, keyword, product, or vendor
- [Malware Families](https://ismalicious.com/malware): Malware family tracking and IOC data
- [Phishing Intelligence](https://ismalicious.com/data/phishing-urls): Active phishing campaign and URL data
- [C2 Intelligence](https://ismalicious.com/data/c2-feeds): Command-and-control server tracking
- [Ransomware Leak Sites](https://ismalicious.com/security/dark-web): Victim posts published on ransomware leak sites
- [Vulnerability Intelligence](https://ismalicious.com/security/vulnerabilities): CVE enrichment with CVSS, EPSS, KEV status
- [Certificate Intelligence](https://ismalicious.com/security/certificates): TLS/SSL certificate reputation
- [Breach-Associated Domains](https://ismalicious.com/security/breaches): Domains tied to publicly disclosed breaches; a domain-level signal, not a credential search
- [SBOM Analysis](https://ismalicious.com/security/sbom): Software Bill of Materials vulnerability scanning
- [Blocklist](https://ismalicious.com/blocklist): Live malicious IP/domain blocklist

## Data Products

- [Threat Feeds](https://ismalicious.com/data/feeds): Structured threat intelligence feeds
- [Blocklists](https://ismalicious.com/blocklist): Curated malicious IP and domain blocklists
- [STIX/TAXII](https://ismalicious.com/data/stix-taxii): Standards-based threat sharing
- [Ransomware Tracker](https://ismalicious.com/ransomware): Ransomware group and victim data
- [C2 Feeds](https://ismalicious.com/data/c2-feeds): Command-and-control infrastructure feeds
- [Phishing URLs](https://ismalicious.com/data/phishing-urls): Active phishing URL dataset
- [Malware Hashes](https://ismalicious.com/data/malware-hashes): Known malware file hash database

## Solutions

- [SOC Teams](https://ismalicious.com/solutions/soc): Accelerate triage with real-time threat enrichment
- [SIEM Integration](https://ismalicious.com/solutions/siem): Enrich SIEM alerts with threat context
- [Firewall Enrichment](https://ismalicious.com/solutions/firewall): Automated firewall blocklist updates
- [Email Security](https://ismalicious.com/solutions/email-security): Phishing domain and sender reputation
- [MSSP](https://ismalicious.com/solutions/mssp): Multi-tenant threat intelligence for managed services
- [Enterprise](https://ismalicious.com/solutions/enterprise): Enterprise-grade threat intelligence platform
- [Developers](https://ismalicious.com/solutions/developers): API-first integration for security tools
- [Compliance](https://ismalicious.com/solutions/compliance): Threat data for regulatory compliance
- [Incident Response](https://ismalicious.com/solutions/incident-response): IOC lookup during active incidents

## Integrations

- [MCP Server](https://ismalicious.com/mcp): Setup guide for Claude, Cursor and Codex. Tools: check_indicator for IP/domain/URL/hash reputation; get_cve and recent_cves for vulnerabilities; scan_before_use for prompt injection and link reputation; scan_email for one inbound email message (phishing and malware verdict, recommended action, reasons); check_url for pre-fetch URL checks; check_password_exposure for breached passwords (hashed locally, only a 5-character prefix is sent).
- [Cortex / TheHive](https://ismalicious.com/integrations/cortex): Official Cortex-Analyzers v3.6.8+
- [IntelOwl](https://ismalicious.com/integrations/intelowl): Observable analyzer for IntelOwl playbooks, proposed upstream (pull request #4090, a draft under review)
- [OpenCTI](https://ismalicious.com/integrations/opencti): Enrichment connector for the OpenCTI platform
- [Microsoft Sentinel](https://ismalicious.com/integrations/microsoft-sentinel): TAXII 2.1 indicator ingest
- [MISP](https://ismalicious.com/integrations/misp): TAXII ingest and expansion module
- [n8n](https://ismalicious.com/integrations/n8n): Community node for IOC lookups

## Available in

Integrations published in each platform's own catalogue or repository, every page opened on 2026-10-18:

- [Cortex XSOAR](https://cortex.marketplace.pan.dev/marketplace/details/IsMalicious/): IsMalicious pack on the Cortex Marketplace (community, 1.0.0, 2026-10-07)
- [OpenCTI](https://hub.filigran.io/cybersecurity-solutions/opencti-integrations/ismalicious): Enrichment connector, listed on the Filigran Hub
- [MISP](https://github.com/MISP/misp-modules/blob/main/misp_modules/modules/expansion/ismalicious.py): Expansion and hover module in misp-modules, shipped since v3.0.10
- [Cortex / TheHive](https://github.com/TheHive-Project/Cortex-Analyzers/tree/master/analyzers/isMalicious): Analyzer in TheHive-Project/Cortex-Analyzers, since 3.6.8
- [Tenzir](https://github.com/tenzir/library/tree/main/ismalicious): Package in the Tenzir Library: indicator lookups and the TAXII feeds
- [Elastic](https://www.elastic.co/docs/reference/integrations/ti_custom): TAXII setup documented in Elastic’s Custom Threat Intelligence integration
- [Velociraptor](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.ismalicious/): Server.Enrichment.IsMalicious artifact on the Artifact Exchange

## Setup guides

Blocklists are text files rebuilt every 12 hours at https://api.ismalicious.com/blocklist/download/{filename}. Send HTTP Basic auth (username = API key, password = API secret), or the header X-API-KEY: base64(key:secret); never the raw key:secret and never a query-string key. A free key, or no key, receives the first 10% of each list.

- [FortiGate threat feed](https://ismalicious.com/integrations/fortigate): FortiOS sends HTTP basic authentication with each threat feed request, so the FortiGate downloads the full isMalicious list itself, with nothing to relay. Block the IPs in firewall policies and the domains in a DNS filter.
- [Palo Alto EDL blocklist](https://ismalicious.com/integrations/palo-alto-networks): PAN-OS loads isMalicious lists as External Dynamic Lists with client authentication and a certificate profile. The 50,000 riskiest critical IPs fit the IP budget of every model; block them in security rules, and domains by DNS sinkholing.
- [pfSense malicious IP blocklist](https://ismalicious.com/integrations/pfsense): pfSense and pfBlockerNG send no credentials, so a host you control fetches the full isMalicious list with your API key and serves it to the firewall over HTTPS. Load it as a URL Table alias, or as a pfBlockerNG feed, which can refresh every hour and adds DNSBL.
- [OPNsense blocklist](https://ismalicious.com/integrations/opnsense): OPNsense 25.1 and later send Basic authorization with a URL Table alias, so the firewall fetches the full isMalicious IP list itself. Its Unbound DNS blocklists cannot authenticate: the domain lists go through a relay you control.
- [MikroTik adlist blocklist](https://ismalicious.com/integrations/mikrotik): RouterOS fetch sends HTTP Basic with its first request, so the router downloads the full isMalicious list itself, then loads the file as a DNS adlist. A scheduled script refreshes it.
- [Linux firewall IP blocklist](https://ismalicious.com/integrations/linux-firewall): curl downloads the full isMalicious list with your API key, read from a root-only netrc file. A script loads the addresses into nftables sets with drop rules and replaces them in one transaction; a systemd timer runs it every hour.
- [Pi-hole malware blocklist](https://ismalicious.com/integrations/pi-hole): Pi-hole hands the credentials in an adlist address to curl as HTTP Basic, so gravity loads the full isMalicious list. Run gravity every 12 hours to follow the rebuilds.
- [AdGuard Home blocklist](https://ismalicious.com/integrations/adguard-home): AdGuard Home fetches lists with Go’s HTTP client, which sends the credentials in a list URL as HTTP Basic, so the full isMalicious list loads. Set the update interval to 12 hours to follow the rebuilds.
- [Splunk threat intelligence lookups](https://ismalicious.com/integrations/splunk): A scripted input fetches each list with your API key, refuses the 10% sample and rebuilds a CSV lookup every 12 hours. Enterprise Security reads an internal copy; the HEC push sends IOCs on demand.
- [Elastic Security TAXII threat feed](https://ismalicious.com/integrations/elastic-security): The Custom Threat Intelligence integration polls an isMalicious TAXII 2.1 collection with your API key and keeps one document per indicator, ready for indicator match rules. Without a TAXII plan, a list loads as a value list.
- [Wazuh threat intelligence CDB lists](https://ismalicious.com/integrations/wazuh): Wazuh reads CDB lists from local files only, so a cron script on the manager downloads the full isMalicious lists with your API key and converts them to CDB keys. Rules then match event fields against them.
- [Suricata dataset blocklist](https://ismalicious.com/integrations/suricata): Suricata reads local files only, so a cron script on the sensor downloads the full isMalicious lists with your API key and writes them as dataset files. Rules match IP addresses, DNS queries and HTTP hosts against them.
- [QRadar reference set of malicious IPs](https://ismalicious.com/integrations/qradar): QRadar downloads no list itself, so a script downloads the full isMalicious list with your API key, empties a reference set and refills it through the QRadar REST API. Rules then test event and flow properties against the set.

## Resources

- [Whitepapers](https://ismalicious.com/resources/whitepapers): Curated industry security research
- [Documentation](https://ismalicious.com/resources/documentation): Platform guides and API reference
- [Case Studies](https://ismalicious.com/resources/case-studies): Customer success stories
- [Status](https://ismalicious.com/resources/status): Platform uptime and incident history

## Playbooks

- [Ingest Threat Intelligence over TAXII Without Vendor Tools](https://ismalicious.com/playbooks/ingest-threat-intelligence-taxii-without-vendor-tools): Share and ingest threat intelligence using open standards: pull STIX 2.1 indicators from a TAXII 2.1 feed with curl, jq, and cron — then plug the same feed into Splunk, Elastic, OpenCTI, or MISP.
- [CVE Prioritization with KEV, EPSS, and isMalicious](https://ismalicious.com/playbooks/cve-prioritization-kev-epss): Build an API-driven vulnerability queue that combines CISA KEV, EPSS exploit probability, and CVSS severity from isMalicious CVE data — so patch teams fix what attackers exploit first.
- [Lightweight Reputation Checks vs Full Threat Analysis](https://ismalicious.com/playbooks/lightweight-reputation-checks): Choose GET /check/reputation when you only need vendor-style verdict counts, and reserve GET /check for investigations. Includes curl examples and when to add /check/whois or /check/location.
- [Automating Malicious IP and Domain Blocklist Downloads](https://ismalicious.com/playbooks/blocklist-download-automation): Use GET /blocklist/stats for freshness, then GET /blocklist/download/{filename} to pull plain-text lists into your WAF, DNS firewall, or SOAR— with curl, diff, and cron-friendly patterns.
- [Bulk IOC Triage with the isMalicious Batch API](https://ismalicious.com/playbooks/bulk-ioc-triage-threat-api): Turn a CSV or SIEM export into scored verdicts in minutes. Use GET /bulk/check for limits, then POST /bulk/check with mixed domains, IPs, and URLs—curl and Python included.
- [Phishing Domain Detection with Typosquatting Analysis](https://ismalicious.com/playbooks/phishing-domain-detection-typosquatting): Build an automated pipeline to detect phishing domains targeting your brand. Uses typosquatting generation, DNS resolution, and isMalicious reputation checks to catch threats before victims do.
- [Blocking Malicious IPs with Firewall Automation](https://ismalicious.com/playbooks/firewall-blocklist-automation): Automatically update firewall blocklists using isMalicious threat data. Covers pfSense, iptables, Palo Alto, and cloud security groups (AWS/GCP/Azure). Zero manual effort after setup.
- [Enriching SIEM Alerts with isMalicious Threat Intel](https://ismalicious.com/playbooks/siem-enrichment-ismalicious-api): Integrate isMalicious API into Splunk and Elastic to auto-enrich every alert with IP/domain reputation, categories, and risk scores. Includes lookup tables and correlation searches.
- [Detecting C2 Beacons with YARA Rules](https://ismalicious.com/playbooks/detecting-c2-beacons-yara): Build and deploy YARA rules to detect Command & Control beacon traffic in your network. Includes copy-paste rules for Cobalt Strike, Sliver, and Metasploit.

## Blog (recent posts)

- [VEX: When Should You Accept not_affected?](https://ismalicious.com/posts/vex-cve-not-affected-review): Check the product, version, justification, and evidence in a VEX advisory before closing a CVE alert or postponing a patch.
- [VEX : quand accepter un statut not_affected ?](https://ismalicious.com/fr/posts/vex-cve-statut-not-affected): Vérifiez le produit, la version, la justification et les preuves d’un avis VEX avant de clôturer une alerte CVE ou de suspendre un correctif.
- [Certificat révoqué : lire OCSP et CRL sans confusion](https://ismalicious.com/fr/posts/certificat-revoque-ocsp-crl-reputation): Distinguez révocation, expiration et réputation d’un domaine. Vérifiez le certificat exact, la fraîcheur du statut et le résultat côté client.
- [Revoked Certificates: Interpret OCSP and CRL Results](https://ismalicious.com/posts/revoked-certificate-ocsp-crl-reputation): Separate revocation, expiration, and domain reputation. Verify the exact certificate, status freshness, and behavior observed by the client.
- [How to Analyze an Encrypted ZIP Attachment](https://ismalicious.com/posts/encrypted-zip-attachment-analysis): Handle a password-protected archive without opening it on a user workstation: collection, isolation, hashes, and a documented decision.
- [Pièce jointe ZIP chiffrée : comment l’analyser](https://ismalicious.com/fr/posts/piece-jointe-zip-chiffree-analyse): Traitez une archive protégée par mot de passe sans l’ouvrir sur le poste utilisateur : collecte, isolation, empreintes et décision documentée.
- [Calculate a File’s SHA-256 Hash with PowerShell](https://ismalicious.com/posts/calculate-sha256-powershell-suspicious-file): Calculate SHA-256 without executing a file, compare it with the correct reference, and document the limits of a hash reputation result.
- [Calculer le SHA-256 d’un fichier avec PowerShell](https://ismalicious.com/fr/posts/calculer-sha256-powershell-fichier-suspect): Calculez une empreinte SHA-256 sans exécuter le fichier, comparez la bonne référence et consignez les limites du résultat de réputation.
- [TAXII Pagination: Sync Without Losing Feed Additions](https://ismalicious.com/posts/taxii-pagination-added-after-sync): Separate added_after, date_added, and modified, then test cursors, object versions, and crash recovery in a TAXII 2.1 client.
- [TAXII : paginer sans perdre les ajouts du flux](https://ismalicious.com/fr/posts/taxii-pagination-added-after-synchronisation): Distinguez added_after, date_added et modified, puis testez les curseurs, les versions et la reprise après panne d’un client TAXII 2.1.
- [STIX : distinguer Indicator et Observed Data](https://ismalicious.com/fr/posts/stix-indicator-observed-data-differences): Séparez une règle de détection, un fait observé et un Sighting STIX pour importer vos IOC sans transformer chaque trace en menace.
- [STIX: Indicator vs Observed Data](https://ismalicious.com/posts/stix-indicator-vs-observed-data): Separate a detection pattern, an observed fact, and a STIX Sighting so your IOC pipeline does not turn every recorded event into a threat.
- [Defang and Refang: Handle hxxp and IOCs Correctly](https://ismalicious.com/posts/defang-refang-ioc-hxxp-guide): Share defanged IOCs while retaining usable evidence: separate display, conversion, validation and submission to external services.
- [Defang et refang : traiter hxxp et les IOC sans erreur](https://ismalicious.com/fr/posts/defang-refang-ioc-hxxp): Partagez des IOC neutralisés tout en conservant une valeur exploitable : distinguez affichage, conversion, validation et soumission à un service externe.
- [Normalisation URL : éviter les erreurs de matching IOC](https://ismalicious.com/fr/posts/normalisation-url-correspondance-ioc): Comparez les URL sans perdre les preuves : casse, encodage, paramètres et fragments demandent des règles explicites et des tests de non-correspondance.
- [URL Normalization: Avoid Incorrect IOC Matches](https://ismalicious.com/posts/url-normalization-ioc-matching): Compare URLs while preserving evidence: case, encoding, parameters and fragments need explicit rules and tests for values that must stay distinct.
- [IP Allowlists: Control the Scope of CIDR Ranges](https://ismalicious.com/posts/ip-allowlist-cidr-security): Verify an IP exception’s scope, test CIDR boundaries and IPv6, then document its owner, review date and conditions for removal.
- [Liste d’autorisation IP : maîtriser les plages CIDR](https://ismalicious.com/fr/posts/liste-autorisation-ip-cidr-securite): Vérifiez le périmètre d’une exception IP, testez les bornes CIDR et IPv6, puis documentez le propriétaire, la durée et le retrait de l’autorisation.
- [X-Forwarded-For : retrouver une IP client fiable](https://ismalicious.com/fr/posts/x-forwarded-for-ip-client-fiable): Identifiez l’IP à enrichir derrière vos proxys en définissant les relais de confiance, puis testez les en-têtes forgés et les accès directs.
- [X-Forwarded-For: Identify a Trusted Client IP](https://ismalicious.com/posts/x-forwarded-for-trusted-client-ip): Choose the right IP to enrich behind proxies by defining trusted relays, then test forged headers, malformed values and direct origin access.
- [DNSSEC et SERVFAIL : trouver la cause de l’échec](https://ismalicious.com/fr/posts/dnssec-servfail-diagnostic): Diagnostiquez un SERVFAIL avec les erreurs DNS détaillées, la chaîne DS/DNSKEY et les signatures, puis vérifiez la réparation sans désactiver DNSSEC.
- [DNSSEC and SERVFAIL: Find the Cause of Resolution Failure](https://ismalicious.com/posts/dnssec-servfail-troubleshooting): Diagnose SERVFAIL using detailed DNS errors, the DS/DNSKEY chain and signatures, then verify the repair with DNSSEC validation enabled.
- [DNS TTL: Investigate a Change of IP Address](https://ismalicious.com/posts/dns-ttl-ip-change-investigation): Reconstruct DNS address changes using dated responses, caches and network views, without confusing TTL with the lifetime of a threat.
- [TTL DNS : enquêter sur un changement d’IP](https://ismalicious.com/fr/posts/ttl-dns-changement-ip-investigation): Reconstituez un changement d’adresse DNS avec des réponses datées, les caches et les vues réseau, sans confondre TTL et durée de menace.
- [NXDOMAIN : diagnostiquer une anomalie DNS](https://ismalicious.com/fr/posts/nxdomain-dns-diagnostic-securite): Distinguez nom inexistant, cache négatif, filtrage et activité suspecte avant de transformer des erreurs NXDOMAIN en incident de sécurité.
- [NXDOMAIN: Diagnose a DNS Security Anomaly](https://ismalicious.com/posts/nxdomain-dns-security-diagnosis): Separate nonexistent names, negative caching, filtering and suspicious activity before treating NXDOMAIN errors as a security incident.
- [CNAME Cloaking: Investigate a Third-Party Subdomain](https://ismalicious.com/posts/cname-cloaking-dns-investigation): Trace CNAME records, identify the provider, and inspect transmitted cookies before deciding whether a subdomain should remain authorized.
- [CNAME cloaking : enquêter sur un sous-domaine tiers](https://ismalicious.com/fr/posts/cname-cloaking-enquete-dns): Suivez la chaîne CNAME, identifiez le prestataire et contrôlez les cookies transmis avant de décider si un sous-domaine doit rester autorisé.
- [Domaine parqué : évaluer le risque avant de bloquer](https://ismalicious.com/fr/posts/domaine-parque-reputation-risque): Distinguez parking, expiration et comportement malveillant. Examinez l’usage réel du domaine et choisissez une restriction proportionnée.
- [Parked Domains: Assess the Risk Before Blocking](https://ismalicious.com/posts/parked-domain-reputation-risk): Distinguish domain parking, expiration, and malicious behavior. Examine actual use and choose a restriction supported by the evidence.
- [RDAP: Read Domain Data During an Investigation](https://ismalicious.com/posts/rdap-domain-investigation-data): Use RDAP events, statuses, and contacts to document a suspicious domain without misattributing an identity or claiming an unproven compromise.
- [RDAP : lire les données d’un domaine en enquête](https://ismalicious.com/fr/posts/rdap-enquete-domaine-donnees): Exploitez les événements, statuts et contacts RDAP pour documenter un domaine suspect sans attribuer à tort une identité ou une compromission.
- [Rapport DMARC XML : interpréter les échecs](https://ismalicious.com/fr/posts/analyser-rapport-dmarc-xml): Lisez les rapports DMARC agrégés, distinguez alignement et authentification, puis classez les anomalies par service et impact métier.
- [DMARC XML Reports: Interpret Authentication Failures](https://ismalicious.com/posts/analyze-dmarc-xml-reports): Read aggregate DMARC reports, distinguish alignment from authentication, and prioritize anomalies by sending service and business impact.
- [SPF Permerror: Fix the DNS Lookup Limit](https://ismalicious.com/posts/spf-permerror-dns-lookup-limit): Trace SPF dependencies, distinguish permerror from fail, and reduce DNS lookups while testing every sending service.
- [SPF permerror : corriger la limite des recherches DNS](https://ismalicious.com/fr/posts/spf-permerror-limite-recherches-dns): Reconstituez les dépendances SPF, distinguez permerror et fail, puis réduisez les recherches DNS avec des tests pour chaque service d’envoi.
- [Erreur SMTP 550 5.7.1 : trouver la cause du rejet](https://ismalicious.com/fr/posts/erreur-smtp-550-5-7-1-reputation): Un rejet 550 5.7.1 peut venir de la politique destinataire, de l’authentification ou de la réputation. Retrouvez la cause avec les bonnes traces.
- [SMTP 550 5.7.1: Find the Cause of an Email Rejection](https://ismalicious.com/posts/smtp-550-5-7-1-rejection-diagnosis): A 550 5.7.1 rejection can involve recipient policy, authentication, or reputation. Use the full diagnostic and delivery traces to find the cause.
- [Analyser les en-têtes d’un e-mail suspect](https://ismalicious.com/fr/posts/analyser-entetes-email-phishing): Identifiez les serveurs fiables, interprétez Authentication-Results et reliez un e-mail suspect à ses liens sans confondre identité et contenu.
- [How to Analyze Suspicious Email Headers](https://ismalicious.com/posts/analyze-suspicious-email-headers): Identify trusted servers, interpret Authentication-Results, and investigate a suspicious email without confusing authentication with safe content.
- [Accès distant des prestataires du secteur public : guide](https://ismalicious.com/fr/posts/acces-distant-prestataires-secteur-public): Encadrez les accès prestataires avec identités nominatives, créneaux approuvés, chemins limités et révocation vérifiée, grâce à un exemple de collectivité.
- [Achats de threat intelligence : guide du secteur public](https://ismalicious.com/fr/posts/achats-threat-intelligence-secteur-public): Préparez un achat CTI public avec des exigences vérifiables, les droits d’usage, la protection des données, une recette technique et un plan de sortie.
- [DNS protecteur : déploiement dans le secteur public](https://ismalicious.com/fr/posts/dns-protecteur-secteur-public): Déployez un DNS protecteur sur les sites publics et les postes nomades. Vérifiez la couverture, gérez les exceptions et préparez la continuité des services.
- [Government Threat Intelligence Procurement: A Practical Guide](https://ismalicious.com/posts/government-threat-intelligence-procurement): Specify a public-sector threat intelligence service with clear evidence, data-handling rules, acceptance tests and an exit plan for UK and European teams.
- [Local Government Network Security: A 90-Day Council Plan](https://ismalicious.com/posts/local-government-network-security): Build a council network security plan around public services, clear ownership, tested segmentation and useful logs, with practical actions across 90 days.
- [Protective DNS for the Public Sector: A Deployment Guide](https://ismalicious.com/posts/protective-dns-public-sector): Deploy protective DNS across public-sector sites and remote staff. Test coverage, handle exceptions and keep essential services available during failures.
- [Public Sector Supplier Remote Access: Control Every Session](https://ismalicious.com/posts/public-sector-third-party-remote-access): Control supplier remote access with named identities, agreed work windows, bounded paths and verified revocation, using a practical public sector example.
- [School Network Security: Test Segmentation That Works](https://ismalicious.com/posts/school-network-security-segmentation): Plan school network segmentation around teaching needs, test permitted and blocked paths, protect administration, and manage changes without losing access.
- [Sécurité réseau des collectivités : plan de 90 jours](https://ismalicious.com/fr/posts/securite-reseau-collectivites-locales): Construisez un plan de sécurité réseau pour votre collectivité : services publics, responsables identifiés, segmentation testée et journaux utiles en 90 jours.
- [Réseau scolaire : tester et maintenir la segmentation](https://ismalicious.com/fr/posts/securite-reseau-etablissements-scolaires-segmentation): Segmentez le réseau scolaire selon les usages, vérifiez les accès autorisés et interdits, préservez les outils pédagogiques et préparez un retour arrière.

## Optional

- [Full content](https://ismalicious.com/llms-full.txt): Complete blog post content in markdown