isMalicious - Threat Intelligence API

Name: isMalicious - Threat Intelligence API
Brand: isMalicious
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat DetectionapiKey12 EndpointsREST

For Agents

Install Jentic One Beta

Connect the isMalicious - Threat Intelligence API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the isMalicious - Threat Intelligence API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fismalicious.com%2Fismalicious" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fismalicious.com%2Fismalicious" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with isMalicious - Threat Intelligence API.

Run a full threat analysis on a domain, IP, or URL covering reputation, geolocation, and certificates in one call

Submit an indicator for community blocklist consideration via POST /submit

Download a blocklist file by name for offline use in firewalls or DNS sinkholes

GET STARTED

Start building with isMalicious - Threat Intelligence API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use isMalicious - Threat Intelligence API for, with concrete tasks.

★ SOC enrichment of detection alerts

When a SIEM raises an alert containing a suspicious indicator, the SOC pipeline calls GET /check on the IP, domain, or URL. The response combines reputation score, geolocation, and certificate context, letting the analyst triage in seconds rather than chasing the indicator through several separate tools. Integrates well with SOAR playbooks that need a single canonical context call.

For the IP 8.8.8.8, call GET /check and return reputation score, country code, and ASN

Outbound URL filtering for messaging platforms

Inspect URLs in user-submitted content before they reach recipients by calling GET /check/reputation. The agent blocks or warns on URLs whose reputation falls below a threshold, reducing phishing exposure on the platform. The 60 requests per minute Basic tier accommodates moderate-traffic messaging products without needing a custom contract.

For the URL 'https://example.com/login', call GET /check/reputation and reject the message if score is below 30

Threat hunting via keyword search

Hunt across the isMalicious feed for indicators tied to a specific campaign by calling POST /search with a keyword. The endpoint returns matching domains, IPs, and URLs that the analyst can pivot from. Combines naturally with GET /check/whois to build out attribution chains during an active investigation.

Search the feed for the keyword 'qakbot' and return the first 50 matching indicators

Bulk reputation check for blocklist refresh

Refresh an internal blocklist nightly by sending a curated list of suspect indicators to POST /bulk/check. The endpoint returns reputation, recency, and confidence values that the agent uses to keep only currently active malicious indicators in the blocklist. Reduces false positives compared to time-decayed blocklists that never re-validate older entries.

Submit the supplied list of 500 IPs to POST /bulk/check and return only those with reputation below 20

AI security agent answering analyst chat queries

An AI agent embedded in the SOC chat tool answers analyst questions like 'is this domain malicious' by routing through Jentic to GET /check. Through Jentic the agent searches for 'check threat indicator' and the matching isMalicious operation is loaded with the API key already injected. Reduces context-switching between Slack and the threat intel portal.

When asked 'is evil-domain.com malicious', call GET /check with the domain and summarise the reputation verdict

Key Endpoints

12 endpoints — jentic publishes the only available openapi specification for ismalicious - threat intelligence api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/check

Run a full threat analysis on an indicator

GET

/check/reputation

Get reputation score for an indicator

GET

/check/whois

Get WHOIS data for a domain

GET

/check/certificates

Get TLS certificates for a domain

POST

/search

Search the feed by keyword

POST

/submit

Submit an indicator to the community feed

POST

/bulk/check

Run a bulk indicator check

GET

/blocklist/download/{filename}

Download a named blocklist

GET

/check

Run a full threat analysis on an indicator

GET

/check/reputation

Get reputation score for an indicator

GET

/check/whois

Get WHOIS data for a domain

GET

/check/certificates

Get TLS certificates for a domain

POST

/search

Search the feed by keyword

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the isMalicious API by hand means base64-encoding your apiKey and apiSecret into the X-API-KEY header, calling api.ismalicious.com, and splitting single, bulk, and search lookups across separate endpoints. Through Jentic you install once, import isMalicious from the API Directory, store the key once, and your agent calls it.

Permission scoping

isMalicious mixes read-only reputation lookups with body-driven search, submit, and bulk-check calls, so limit the agent to the operations it needs, such as checking IP reputation or bulk-checking indicators. You choose the operations it may call, so submissions stay out unless you add them.

Credential isolation

Your isMalicious X-API-KEY is stored once, encrypted, by your own Jentic One instance and injected into the request header at execution time. The base64-encoded apiKey and apiSecret never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'check IP reputation' or 'bulk check indicators', and Jentic returns the matching isMalicious operation with its input schema, so the agent calls the right endpoint without reading the docs.

FAQs

Specific to using isMalicious - Threat Intelligence API through Jentic.

Why is there no official OpenAPI spec for isMalicious - Threat Intelligence API?

isMalicious does publish a JSON spec at api.ismalicious.com/openapi.json, but it changes frequently and lacks Jentic's enrichment fields. Jentic mirrors and validates this spec so AI agents and developers can call isMalicious via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the isMalicious API use?

isMalicious uses an API key passed in the X-API-KEY request header. The value is the base64 encoding of apiKey:apiSecret obtained from ismalicious.com/app/account. Through Jentic the credential is held in the vault and injected at request time - agents never see the raw value.

Can I run a bulk reputation check in one call?

Yes. POST /bulk/check accepts an array of indicators and returns a per-indicator reputation map. GET /bulk/check returns current usage and remaining quota so the agent can throttle itself before hitting plan caps.

What are the rate limits for the isMalicious API?

Rate limits are tiered: Free 10 per minute and 100 per day, Basic 60 per minute and 5000 per day, Pro 300 per minute and 50000 per day, with custom plans available. Over-quota requests return HTTP 429.

How do I check a single indicator through Jentic?

Search Jentic with the query 'check threat indicator' or 'is this IP malicious', load the GET /check operation, and execute it with the indicator as a query parameter. The response includes reputation score, geolocation, and any vulnerability or WHOIS context that is available.

Does isMalicious return TLS certificate data for domains?

Yes. GET /check/certificates returns the TLS certificates observed for the domain, including issuer, validity window, and SAN list. Useful for spotting certificates issued to lookalike domains during a phishing investigation.

Can I limit what my agent is allowed to do with the isMalicious API?

Yes. Because Jentic One is self-hosted, you set the rules for which isMalicious operations your agent may call, so you can allow read-only reputation lookups like GET /check and GET /check/reputation while keeping write operations such as POST /submit off limits. If you only need bulk triage, you can grant POST /bulk/check and POST /search and nothing else. Your instance also holds the X-API-KEY and injects it at request time, so the agent scopes access without ever seeing the raw credential.

isMalicious - Threat Intelligence API

Connect the isMalicious - Threat Intelligence API to your agent

Capabilities

Start building with isMalicious - Threat Intelligence API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs