Integration
n8n Community Node IOC lookup inside an existing workflow
Drop a Check indicator node on the canvas, attach your isMalicious API credential, and enrich the item. This is a catalog node, not a dashboard destination.
No credit card required · Free API key
Capabilities
Key features. Everything you need to protect your infrastructure and users.
Check IOC
IP, domain, or URL → malicious flag, score, categories, sources.
No extra deps
Uses n8n helpers.httpRequest so the package can be verified.
Same /check API
The lookup paying customers already run from scripts and Cortex.
Self-hosted install
Community nodes panel, or npm install n8n-nodes-ismalicious.
Applications
Use cases. How security teams use this tool.
Alert enrichment
Take an IP from a webhook or SIEM poll and attach an isMalicious report before Slack/email.
Allow/deny gates
Branch the workflow on malicious=true without a custom HTTP node.
Support
Frequently asked questions.
Where is the node published?
The source lives at packages/n8n-nodes-ismalicious. Publish as n8n-nodes-ismalicious on npm, then submit the package in the n8n Creator Portal for verification.
What does the node do?
One operation: Check indicator. It calls GET /check with X-API-KEY and returns the JSON report. No webhook trigger in v0.1.0.
Does it add n8n dependencies?
No runtime dependencies. Verified community nodes cannot ship extra packages; the node uses n8n helpers.httpRequest.
Explore
Related tools.
Get started
Ready to get started?
Join thousands of security teams using isMalicious to protect their infrastructure.
No credit card required · Free API key