Domain Malicious
Check if a domain or IP address has been flagged as malicious across multiple threat intelligence feeds, with source attribution.
Credit cost: 1 credit per call
ApiKeyAuthx-api-key<token>Your API key. Include it in the x-api-key header for every request.
query*stringA domain name or IP address to check for malicious activity across multiple threat intelligence sources.
Examples:
197.33.189.70malicious-domain.comThe API cross-references the input against community-curated threat feeds and returns whether it has been flagged as malicious, along with the specific sources that reported it.
Note: Both IPv4 addresses and domain names are accepted.
fields?stringComma-separated list of response fields to return, with dot notation for nested fields (e.g. name,location.city).
is_async?booleanRun the request as a background job: the API answers 202 with a job_id to poll on GET /v1/jobs/{id}.
falsesoft_fail?booleanReturn HTTP 200 even when the request fails; the error is in the error field of the body.
falseSuccessful response
application/json- response
sources?array<>malicious?booleancurl -X GET 'https://api.piloterr.com/v2/domain/malicious?query=string'{ "sources": [ { "url": "https://raw.githubusercontent.com/duggytuxy/malicious_ip_addresses/main/blacklist_ips_for_fortinet_firewall_ab.txt", "name": "Fortinet Firewall AB", "type": "ip" }, { "url": "https://raw.githubusercontent.com/duggytuxy/malicious_ip_addresses/main/botnets_zombies_scanner_spam_ips.txt", "name": "Botnets, Zombies, Scanner, Spam IPs", "type": "ip" } ], "malicious": true}