submit

Submit Sources

Changed on Aug 31, 2026

Submit new threat intelligence sources (max 50 per request) to the community database. Requires an organization-linked account. Each URL is probed for reachability before acceptance; already-known URLs are skipped and counted in duplicatesSkipped. Daily submission caps are per plan.

Categories: malware, phishing, spam, scam, fraud, botnet, ransomware, c2

post/submit

Request

Base URL
https://api.ismalicious.com
Auth
- API key in header X-API-KEY
- or HTTP bearer
- or HTTP basic

Request body

Example request

{
  "sources": [
    {
      "name": "Example Threat Feed",
      "url": "https://example.com/threats-ips.txt"
    }
  ]
}

Response

Submission accepted (also returned when every source was already known — inserted: 0)

duplicatesSkippedinteger required

Number of sources skipped because they already exist

insertedinteger required

Number of sources inserted for review

messagestring required

Success message

Example response

{
  "message": "Submitted successfully! 2 source(s) are pending admin review."
}

Changes

Aug 31, 20269d9ef31d83e5 Revision changes
- breaking
  the response property became nullable for the status
- breaking
  the response property became nullable for the status
- breaking
  the response property became optional for the status
- breaking
  the response property became optional for the status
- info
  the request property // became nullable
- info
  the request property // became optional
- info
  added the optional property to the response with the status
- info
  added the required property to the response with the status
- info
  added the required property to the response with the status
- info
  added the required property to the response with the status
Aug 6, 2026521d3d45fadb Revision changes
- breaking
  removed the enum value botnet of the request property //
- breaking
  removed the enum value c2 of the request property //
- breaking
  removed the enum value domain of the request property //
- breaking
  removed the enum value fraud of the request property //
- breaking
  removed the enum value ip of the request property //
- breaking
  removed the enum value malware of the request property //
- breaking
  removed the enum value phishing of the request property //
- breaking
  removed the enum value ransomware of the request property //
- breaking
  removed the enum value scam of the request property //
- breaking
  removed the enum value spam of the request property //
- info
  the // request property format was generalized from uri to no format
- info
  the response property became required for the status
- info
  the response property became required for the status
- info
  the response property became required for the status
- info
  the response property became required for the status
- info
  the response property became required for the status
- info
  the response property became required for the status
- info
  the response property became required for the status

Operation history