ISismalicious
check

Check Certificates

Changed on

The certificate section of a domain. certificateFacts.live is what our own TLS handshake on port 443 observed (this endpoint opens that connection when nothing is cached; no HTTP request is sent, and a domain we rate malicious is not probed); certificateFacts.ctHistory and certificates are Certificate Transparency entries from crt.sh (crt.sh's row shape, normalised: at most 10, current first). The call takes about five seconds at most; a source that did not answer in time reads unknown, never "no certificates". An IP target answers not_applicable and nothing is contacted.

get/check/certificates

Request

  • Base URL
    https://api.ismalicious.com
  • Auth
    • API key in header X-API-KEY
    • or HTTP bearer
    • or HTTP basic

Query parameters

querystring

IP address or domain to check. /check/reputation also accepts a hexadecimal MD5, SHA1, or SHA256 file hash.

Response

Certificate section: {"certificates": <crt.sh rows> | null, "certificateFacts": {status, live, ctHistory}}

certificateFactsobject nullable

The certificate section: live (our TLS handshake on port 443) and ctHistory (crt.sh), each with its source and time.

certificatesobject nullable

Certificate Transparency entries from crt.sh, in crt.sh's row shape (dates without a timezone): at most ten, current ones first.

Changes

  • c0a9ee63924bRevision changes
    • info

      added the optional property to the response with the status

  • 9d9ef31d83e5Revision changes
    • breaking

      the response property became nullable for the status

    • breaking

      the response property became nullable for the status

    • breaking

      the response property became nullable for the status

    • breaking

      the response property became nullable for the status

    • breaking

      the response property became optional for the status

    • breaking

      the response property became optional for the status

    • breaking

      the response property became optional for the status

    • breaking

      the response property became optional for the status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • warning

      deleted the path request parameter enrichment

    • warning

      deleted the path request parameter query

    • info

      added the new optional query request parameter query