# Domain Malicious

## Overview

| Property | Value |
|----------|-------|
| **Status** | active |
| **Method** | `GET` |
| **Endpoint** | `/v2/domain/malicious` |
| **Base URL** | `https://api.piloterr.com` |
| **Credit Cost** | 1 credit per call |
| **Documentation** | https://www.piloterr.com/library/domain-malicious |

## Description

Check if a domain or IP address has been flagged as malicious across multiple threat intelligence feeds, with source attribution.

## Authentication

- **Key Name:** `x-api-key`
- **Location:** HTTP Header
- **Get an API key:** https://app.piloterr.com/register

## Example Request

```bash
curl --location --request GET 'https://api.piloterr.com/v2/domain/malicious' \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: YOUR_API_KEY'
```

## Example Response

### Check malicious IP address

```json
{
  "sources": [
    {
      "url": "https://raw.githubusercontent.com/duggytuxy/malicious_ip_addresses/main/blacklist_ips_for_fortinet_firewall_ab.txt",
      "name": "Fortinet Firewall AB",
      "type": "ip"
    },
    {
      "url": "https://raw.githubusercontent.com/duggytuxy/malicious_ip_addresses/main/botnets_zombies_scanner_spam_ips.txt",
      "name": "Botnets, Zombies, Scanner, Spam IPs",
      "type": "ip"
    }
  ],
  "malicious": true
}
```

### Check clean domain

```json
{
  "sources": [],
  "malicious": false
}
```

## Documentation

## Overview
The Domain Malicious endpoint checks any domain or IP address against community-curated threat intelligence feeds to determine if it has been flagged for malicious activity. It returns a boolean verdict along with the specific sources that reported the threat.

## Quickstart
```
GET https://api.piloterr.com/v2/domain/malicious?query=197.33.189.70
```

## Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| `query` | string | yes | Domain name or IP address to check |

## Response fields
| Field | Type | Description |
|---|---|---|
| `malicious` | boolean | Whether flagged as malicious |
| `sources` | array | Threat feeds that reported the address |
| `sources[].url` | string | URL to the threat list |
| `sources[].name` | string | Source name |
| `sources[].type` | string | Indicator type: `ip` or `domain` |

## Notes
- Aggregates data from multiple open-source threat intelligence feeds.
- Empty `sources` with `malicious: false` means no known threat reports.

## Main use cases
- Screen inbound traffic IPs for known malicious actors
- Validate third-party vendor domains in supply chain security checks
- Enrich SIEM workflows with threat classification data
- Block malicious IPs at the firewall or API gateway level