ISismalicious
search

Search Keywords

Changed on

Domains the corpus lists that look like a brand or domain: typosquats, homoglyphs, the name on other TLDs or wrapped in phishing words (paypal-login). A bare keyword is read as its .com; the searched name itself comes first when listed. Most dangerous first, capped at 500 hits (total_hits counts every lookalike found).

post/search

Request

  • Base URL
    https://api.ismalicious.com
  • Auth
    • API key in header X-API-KEY
    • or HTTP bearer
    • or HTTP basic

Query parameters

keywordsstring required

Brand or domain to find lookalikes of (e.g., 'paypal', 'microsoft'); a bare keyword is read as its .com

Response

Search results response (capped at 500 hits)

hitsstring[] required

Listed lookalike domains, most dangerous first, capped at 500

keywordsstring required

Search keywords used

total_hitsinteger required

Every lookalike found; hits stops at 500

truncatedboolean required

True when hits stops short of total_hits

Example response

{
  "keywords": "paypal",
  "matches": [
    {
      "domain": "paypa1.com",
      "fuzzer": "homoglyph",
      "threatLevel": "critical"
    }
  ]
}

Changes

  • 6526ceebf6fdRevision changes
    • breaking

      added the new required query request parameter keywords

    • warning

      deleted the path request parameter keywords

  • 75b195a61aa9Revision changes
    • info

      added the non-success response with the status

    • info

      added the required property to the response with the status

    • info

      added the required property to the response with the status