Threat Scoring Methodology
How isMalicious aggregates signals from 16+ threat intelligence sources, weights them by source reliability, and produces a single confidence-scored verdict for every IP address, domain, and URL in our database.
Indexed
Threat Records
16+
Intelligence Sources
< 1 hour
Data Refresh
<100ms
Cached Lookup
How the Scoring Pipeline Works
Multi-Source Ingestion
For every lookup, isMalicious queries 16+ recent threat intelligence feeds in parallel. Each source returns a binary flag (malicious / clean) and optional metadata such as threat category, first-seen date, and confidence.
Source Reliability Weighting
Not all sources are equal. Each source carries a reliability weight between 0 and 1 based on historical accuracy and false-positive rates. Google Safe Browsing and CISA KEV sit at 0.95; community-reported sources like StopForumSpam sit at 0.70. A flag from a high-reliability source contributes proportionally more to the final score. Listings that name a URL rather than a host count at half weight when we score the host itself.
Cross-Provider Correlation
Our cross-correlator checks for agreement across distinct provider categories — blocklists, multi-engine scanners, and abuse databases. Agreement across categories carries 12% additional weight because independent detection classes are less likely to share false positives.
Confidence Score Calculation
Six factors are combined into a 0–100 confidence score using fixed weights (see table below). A verdict is marked "malicious" when score ≥ 50 and at least one source flags it. Scores below 30 with a malicious flag are floor-boosted to 35 to avoid misleading low-confidence verdicts.
Enrichment & Context
Each result is enriched with geolocation, ASN, WHOIS registration data, domain age, TLS certificate history, and DNS history. For CVEs, we layer on CVSS v3, EPSS scores from FIRST.org, CISA KEV status, SSVC exploitation classification, CERT-FR advisories, MSRC bulletins, and Exploit-DB references.
Confidence Score Factors
| Factor | Weight | Description |
|---|---|---|
| Source Agreement | 33 % | How many independent sources flag the same indicator |
| Source Quality | 22 % | Reliability score of the flagging sources (0–1 per source) |
| Scanner Consensus | 18 % | Agreement across scanner engine verdicts, when a scanner sample is available |
| Cross-Provider Agreement | 12 % | Confirmation across provider categories (blocklist vs scanner vs abuse) |
| Data Completeness | 10 % | Whether all expected enrichment fields are populated |
| Data Freshness | 5 % | How recently the threat signal was observed |
Intelligence Sources
Sources are queried in parallel and reliability-weighted. Scores are derived from historical accuracy measurement, not self-reported.
| Source | Category | Reliability |
|---|---|---|
| Google Safe Browsing | Phishing & malware | 0.95A |
| PhishTank | Phishing | 0.90A |
| OpenPhish | Phishing | 0.90A |
| URLhaus (abuse.ch) | Malware distribution | 0.90A |
| Abuse.ch | C2 & malware | 0.90A |
| Spamhaus | Spam & abuse | 0.85B |
| SURBL | Spam URL blocklist | 0.85B |
| Feodo Tracker | Banking trojan C2 | 0.85B |
| AlienVault OTX | Threat intelligence | 0.80B |
| Malware Domains | Malware hosting | 0.80B |
| Tor Project | Anonymization network | 0.80B |
| Malware Domain List | Malware hosting | 0.75B |
| Blocklist.de | Brute-force & abuse | 0.75B |
| ThreatCrowd | Threat intelligence | 0.75B |
| AbuseIPDB | IP abuse reporting | 0.70C |
| StopForumSpam | Forum spam | 0.70C |
Data Freshness
Threat intelligence feeds are ingested on a continuous schedule. Most blocklists and abuse feeds refresh every 15–60 minutes. Scanner-based sources (Google Safe Browsing) are queried on-demand per lookup request with short-lived intelligence caching to keep reports fast and fresh.
CVE data is synchronized from NVD, CISA KEV, OpenCVE, CERT-FR, MSRC, GitHub Security Advisories, and FIRST EPSS every 6 hours. EPSS scores are updated daily from FIRST.org.
Ransomware victim data is ingested continuously from monitored leak sites. New victims typically appear within 1–4 hours of publication.
False Positive Handling
False positives are minimized through source quality gating and cross-provider disagreement detection. When our scanner consensus and blocklist sources disagree significantly, we surface a source disagreement signal in the API response rather than forcing a binary verdict.
Major CDN ranges (Cloudflare, Fastly, AWS, Azure, Google Cloud) are tracked separately to avoid flagging shared infrastructure. Domain age, registrar, and certificate transparency data help distinguish newly registered malicious domains from legitimate ones.
Users can report false positives via the Report endpoint. Confirmed false positives are reviewed within 24 hours and propagated to our blocklist suppression layer.
Access the full threat intelligence API
Every score, signal, and source breakdown is available via the isMalicious API — including raw source votes, reliability weights, and cross-correlation signals.