isMalicious Search API

openapi: 3.2.0
info:
  title: Ismalicious Com Search API
  version: 1.2.0
  contact:
    name: isMalicious Support
    url: https://ismalicious.com/support
    email: contact@ismalicious.com
  license:
    name: Proprietary
    url: https://ismalicious.com/terms
  description: 'Operations tagged search across 2 of this provider''s published API definitions: ismalicious-com-openapi.json, ismalicious-com-openapi2.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.ismalicious.com
  description: Production server
security:
- ApiKeyAuth: []
- BearerAuth: []
- BasicAuth: []
tags:
- name: Search
  description: Search for similar malicious domains
paths:
  /search:
    post:
      tags:
      - Search
      summary: Search Keywords
      description: 'Domains the corpus lists that look like a brand or domain: typosquats,

        homoglyphs, the name on other TLDs or wrapped in phishing words

        (`paypal-login`). A bare keyword is read as its `.com`; the searched name

        itself comes first when listed. Most dangerous first, capped at **500

        hits** (`total_hits` counts every lookalike found).'
      operationId: searchKeywords
      parameters:
      - name: keywords
        in: query
        description: 'Brand or domain to find lookalikes of (e.g., ''paypal'', ''microsoft'');

          a bare keyword is read as its `.com`'
        required: true
        schema:
          type: string
        example: paypal
      responses:
        '200':
          description: Search results response (capped at 500 hits)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchResponse'
        '400':
          description: Missing keywords parameter
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized - Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many requests - Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Search could not run (corpus unreachable)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    servers:
    - url: https://api.ismalicious.com
      description: Production server
components:
  schemas:
    SearchResponse:
      type: object
      description: Search response for similar domains (`api/search.rs`)
      required:
      - keywords
      - hits
      - total_hits
      - truncated
      - matches
      properties:
        hits:
          type: array
          items:
            type: string
          description: Listed lookalike domains, most dangerous first, capped at 500
        keywords:
          type: string
          description: Search keywords used
          example: paypal
        matches:
          type: array
          items:
            $ref: '#/components/schemas/SimilarDomainMatch'
          description: '`hits` in the same order, with how each derives and its level'
        total_hits:
          type: integer
          format: int64
          description: Every lookalike found; `hits` stops at 500
          minimum: 0
        truncated:
          type: boolean
          description: True when `hits` stops short of `total_hits`
    ErrorResponse:
      type: object
      description: Error response. Some handlers return only `error`.
      required:
      - error
      properties:
        error:
          type: string
          description: Error type
          example: Bad Request
        message:
          type:
          - string
          - 'null'
          description: Detailed error message (not always present)
          example: 'Missing required parameter: query'
    SimilarDomainMatch:
      type: object
      description: One domain the corpus lists that looks like the searched name
      required:
      - domain
      - fuzzer
      properties:
        domain:
          type: string
          example: paypa1.com
        fuzzer:
          type: string
          description: 'How it derives from the searched name: `original` (the name itself)

            or a dnstwist fuzzer (`homoglyph`, `dictionary`, `tld-swap`,

            `omission`, …), plus `numeral` and `platform-swap`'
          example: homoglyph
        threatLevel:
          type:
          - string
          - 'null'
          description: 'Stored level of its corpus document (`critical`, `high`, `medium`,

            `low`, `none`); null on a document that predates it'
          example: critical
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-KEY
      description: Base64 encoded `apiKey:apiSecret`. Get your keys from https://ismalicious.com/app/account
    BasicAuth:
      type: http
      scheme: basic
      description: 'Username = apiKey, password = apiSecret. Legacy: any username, password = Base64(apiKey:apiSecret).'
    BearerAuth:
      type: http
      scheme: bearer
      description: '`Authorization: Bearer <token>` where token = Base64(apiKey:apiSecret) — the same credential as X-API-KEY.'
    sessionCookie:
      type: apiKey
      in: cookie
      name: __Secure-authjs.session-token
      description: Authenticated browser session. The claim endpoint also requires a verified email in the database; organization API keys cannot claim watches.
x-refined-from:
- ismalicious-com-openapi.json
- ismalicious-com-openapi2.json