API Playground
GET/api/check
⌘K
Endpoint
Params
no key · free anonymous quota
Response
— run a request to see the live JSON here
Full analysisGETidle
Spec merges Rust (
api.ismalicious.com) with Next.js scam routes on ismalicious.com/api (/analyze, phone, crypto, email). Pick the matching server in Scalar before "Try it". Written examples also in API docs.Reference
Every endpoint you can call from this playground
27 operations across 12 groups, generated from isMalicious - Threat Intelligence API v1.0.0 — the same OpenAPI document the interactive reference above loads.
- Production server
- https://api.ismalicious.com
- Next.js web API (analyze / phone / crypto / email)
- https://ismalicious.com/api
- Auth header
- X-API-KEY
| Method | Endpoint | Purpose |
|---|---|---|
| check— Threat intelligence check endpoints for IPs and domains | ||
| GET | /bulk/check | Bulk check limits and usage |
| POST | /bulk/check | Bulk entity check |
| GET | /check | Full Threat Analysis |
| GET | /check/certificates | Check Certificates |
| GET | /check/location | Check Geolocation |
| GET | /check/reputation | Check Reputation |
| GET | /check/vulnerabilities | Check Vulnerabilities |
| GET | /check/whois | Check WHOIS |
| search— Search for similar malicious domains | ||
| POST | /search | Search Keywords |
| blocklist— Download and manage blocklists | ||
| GET | /blocklist/download/{filename} | Download Blocklist |
| GET | /blocklist/stats | Get Blocklist Stats |
| submit— Submit new threat intelligence sources | ||
| POST | /submit | Submit Sources |
| Scam Intelligence— Next.js routes for analyze / email / phone / crypto (ismalicious.com/api). | ||
| POST | ismalicious.com/api/analyze | Unified analyze (auto-detect type) |
| GET | ismalicious.com/api/check/crypto | Check crypto wallet address |
| GET | ismalicious.com/api/check/email | Check email address |
| GET | ismalicious.com/api/check/phone | Check phone number risk |
| action-center | ||
| GET | /action-center/overview | Prioritized SOC action center overview |
| alerts | ||
| GET | /alerts/trends | Opened/resolved per day plus MTTR percentiles for the signed-in scope |
| briefs | ||
| GET | /risk-brief/latest | Latest organization risk brief summary |
| cases | ||
| GET | /cases | Case workspace list |
| POST | /cases | Created case |
| PATCH | /cases/{id} | Updated case |
| POST | /cases/{id}/evidence | Updated case with appended evidence |
| platform | ||
| GET | /platform/data-freshness | Dataset freshness, version, and SLA status |
| GET | /platform/data-ops/pipeline | Data operations pipeline phases and last recorded run |
| trust | ||
| GET | /trust/assessment/schema | Canonical trust assessment field contract |
| webhooks | ||
| GET | /user/webhooks/events | Supported webhook events and recommended payload fields |
Calling one without the playground
# X-API-KEY carries Base64(apiKey:apiSecret)
curl -H "X-API-KEY: $ISMALICIOUS_KEY" \
"https://api.ismalicious.com/check?query=example.com"