canonical: https://jentic.com/apis/ismalicious.com/ismalicious # isMalicious - Threat Intelligence API Jentic publishes the only available OpenAPI specification for isMalicious - Threat Intelligence API, keeping it validated and agent-ready. isMalicious is a threat intelligence service for checking the reputation of domains, IP addresses, and URLs. The 12 endpoints cover full threat analysis, reputation scoring, geolocation, certificate inspection, vulnerability lookup, WHOIS, keyword search, indicator submission, blocklist downloads, and bulk checks for high-volume processing. Plans range from a free tier at 10 requests per minute up to Pro at 300 requests per minute. ## For AI agents Check the reputation of domains, IPs, and URLs against the isMalicious threat intelligence feed - full threat analysis, certificate and WHOIS lookups, plus bulk processing for SOC pipelines. ## Scope Does not handle endpoint detection, malware sandboxing, or vulnerability scanning - use for IP, domain, and URL reputation lookup only. ## Capabilities - Run a full threat analysis on a domain, IP, or URL covering reputation, geolocation, and certificates in one call - Submit an indicator for community blocklist consideration via POST /submit - Download a blocklist file by name for offline use in firewalls or DNS sinkholes - Search the threat feed by keyword to find indicators related to a campaign or actor - Run a bulk check across many indicators in one POST request to feed SOC pipelines - Inspect WHOIS data for a domain to support attribution work ## Use cases ### SOC enrichment of detection alerts When a SIEM raises an alert containing a suspicious indicator, the SOC pipeline calls GET /check on the IP, domain, or URL. The response combines reputation score, geolocation, and certificate context, letting the analyst triage in seconds rather than chasing the indicator through several separate tools. Integrates well with SOAR playbooks that need a single canonical context call. Example prompt: For the IP 8.8.8.8, call GET /check and return reputation score, country code, and ASN ### Outbound URL filtering for messaging platforms Inspect URLs in user-submitted content before they reach recipients by calling GET `/check/reputation.` The agent blocks or warns on URLs whose reputation falls below a threshold, reducing phishing exposure on the platform. The 60 requests per minute Basic tier accommodates moderate-traffic messaging products without needing a custom contract. Example prompt: For the URL 'https://example.com/login', call GET `/check/reputation` and reject the message if score is below 30 ### Threat hunting via keyword search Hunt across the isMalicious feed for indicators tied to a specific campaign by calling POST /search with a keyword. The endpoint returns matching domains, IPs, and URLs that the analyst can pivot from. Combines naturally with GET `/check/whois` to build out attribution chains during an active investigation. Example prompt: Search the feed for the keyword 'qakbot' and return the first 50 matching indicators ### Bulk reputation check for blocklist refresh Refresh an internal blocklist nightly by sending a curated list of suspect indicators to POST `/bulk/check.` The endpoint returns reputation, recency, and confidence values that the agent uses to keep only currently active malicious indicators in the blocklist. Reduces false positives compared to time-decayed blocklists that never re-validate older entries. Example prompt: Submit the supplied list of 500 IPs to POST `/bulk/check` and return only those with reputation below 20 ### AI security agent answering analyst chat queries An AI agent embedded in the SOC chat tool answers analyst questions like 'is this domain malicious' by routing through Jentic to GET /check. Through Jentic the agent searches for 'check threat indicator' and the matching isMalicious operation is loaded with the API key already injected. Reduces context-switching between Slack and the threat intel portal. Example prompt: When asked 'is evil-domain.com malicious', call GET /check with the domain and summarise the reputation verdict ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | `/check` | Run a full threat analysis on an indicator | | GET | `/check/reputation` | Get reputation score for an indicator | | GET | `/check/whois` | Get WHOIS data for a domain | | GET | `/check/certificates` | Get TLS certificates for a domain | | POST | `/search` | Search the feed by keyword | | POST | `/submit` | Submit an indicator to the community feed | | POST | `/bulk/check` | Run a bulk indicator check | | GET | `/blocklist/download/{filename}` | Download a named blocklist | ## Key resources - **Check** — Full threat analysis plus per-aspect reputation, geolocation, certificates, vulnerabilities, and WHOIS lookups - **Search** — Keyword search across the threat feed - **Submit** — Submit indicators for community evaluation - **Blocklist** — Stats on current blocklists and downloads of named files - **Bulk** — Bulk indicator check with usage metering ## Why Jentic - **Setup:** Wiring the isMalicious API by hand means base64-encoding your apiKey and apiSecret into the X-API-KEY header, calling api.ismalicious.com, and splitting single, bulk, and search lookups across separate endpoints. Through Jentic you install once, import isMalicious from the API Directory, store the key once, and your agent calls it. - **Permission scoping:** isMalicious mixes read-only reputation lookups with body-driven search, submit, and bulk-check calls, so limit the agent to the operations it needs, such as checking IP reputation or bulk-checking indicators. You choose the operations it may call, so submissions stay out unless you add them. - **Credential handling:** Your isMalicious X-API-KEY is stored once, encrypted, by your own Jentic One instance and injected into the request header at execution time. The base64-encoded apiKey and apiSecret never enter the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'check IP reputation' or 'bulk check indicators', and Jentic returns the matching isMalicious operation with its input schema, so the agent calls the right endpoint without reading the docs. ## Related APIs - **AbuseIPDB** — Community IP abuse database focused on IP-only reputation rather than full domain and URL coverage - **Shodan** — Internet-wide port and service scanner that surfaces exposed infrastructure for a given IP - **Pulsedive** — Threat intelligence platform with similar IP, domain, and URL coverage and a free community tier ## FAQ ### Why is there no official OpenAPI spec for isMalicious - Threat Intelligence API? isMalicious does publish a JSON spec at api.ismalicious.com/openapi.json, but it changes frequently and lacks Jentic's enrichment fields. Jentic mirrors and validates this spec so AI agents and developers can call isMalicious via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the isMalicious API use? isMalicious uses an API key passed in the X-API-KEY request header. The value is the base64 encoding of apiKey:apiSecret obtained from ismalicious.com/app/account. Through Jentic the credential is held in the vault and injected at request time - agents never see the raw value. ### Can I run a bulk reputation check in one call? Yes. POST `/bulk/check` accepts an array of indicators and returns a per-indicator reputation map. GET `/bulk/check` returns current usage and remaining quota so the agent can throttle itself before hitting plan caps. ### What are the rate limits for the isMalicious API? Rate limits are tiered: Free 10 per minute and 100 per day, Basic 60 per minute and 5000 per day, Pro 300 per minute and 50000 per day, with custom plans available. Over-quota requests return HTTP 429. ### How do I check a single indicator through Jentic? Search Jentic with the query 'check threat indicator' or 'is this IP malicious', load the GET /check operation, and execute it with the indicator as a query parameter. The response includes reputation score, geolocation, and any vulnerability or WHOIS context that is available. ### Does isMalicious return TLS certificate data for domains? Yes. GET `/check/certificates` returns the TLS certificates observed for the domain, including issuer, validity window, and SAN list. Useful for spotting certificates issued to lookalike domains during a phishing investigation. ### Can I limit what my agent is allowed to do with the isMalicious API? Yes. Because Jentic One is self-hosted, you set the rules for which isMalicious operations your agent may call, so you can allow read-only reputation lookups like GET /check and GET `/check/reputation` while keeping write operations such as POST /submit off limits. If you only need bulk triage, you can grant POST `/bulk/check` and POST /search and nothing else. Your instance also holds the X-API-KEY and injects it at request time, so the agent scopes access without ever seeing the raw credential.