Add IsMalicious observable analyzer. Closes #3935

[hexablob]

Description

Add an official observable analyzer for isMalicious (GET /check) covering ip, domain, and url.

Related: #3935

I have reviewed and verified the LLM-assisted scaffolding for this PR (migration boilerplate matches existing dumpplugin migrations such as Rdap / IPQS). The HTTP client, headers, and unit test are checked against the public /check contract.

Type of change

• New feature (non-breaking change which adds functionality).

Checklist

• I have read and understood the rules about how to Contribute to this project
• The pull request is for the branch develop
• A new plugin (analyzer, connector, visualizer, playbook, pivot or ingestor) was added or changed, in which case:
  • I strictly followed the documentation "How to create a Plugin"
  • Usage file was updated. A link to the PR to the docs repo has been added as a comment here. (follow-up after this lands)
  • Advanced-Usage was updated (in case the plugin provides additional optional configuration). Optional url override only; happy to add a docs line if maintainers want it.
  • I have dumped the configuration from Django Admin using the dumpplugin command and added it in the project as a data migration. (Hand-written in the dumpplugin format used by 0194_analyzer_config_rdap.py / 0191_analyzer_config_ipqs_malware_file_scanner.py because this contribution is made out of tree.)
  • If a File analyzer was added and it supports a mimetype which is not already supported, you added a sample of that type inside the archive test_files.zip and you added the default tests for that mimetype in test_classes.py. (observable analyzer)
  • If you created a new analyzer and it is free (does not require any API key), please add it in the FREE_TO_USE_ANALYZERS playbook by following this guide. Requires an API key — not added to FREE_TO_USE.
  • Check if it could make sense to add that analyzer/connector to other freely available playbooks. Maintainers: optional add to DNS/IP enrichment playbooks if desired.
  • I have provided the resulting raw JSON of a finished analysis and a screenshot of the results.
  • If the plugin interacts with an external service, I have created an attribute called precisely url that contains this information. This is required for Health Checks (HEAD HTTP requests).
  • If a new analyzer has beed added, I have created a unittest for it in the appropriate dir. I have also mocked all the external calls, so that no real calls are being made while testing.
  • I have added that raw JSON sample to the get_mocker_response() method of the unittest class. This serves us to provide a valid sample for testing.
  • I have created the corresponding DataModel for the new analyzer following the documentation — omitted for v1, same as several existing reputation analyzers; happy to add one if maintainers prefer.
• I have inserted the copyright banner at the start of the file
• Please avoid adding new libraries as requirements whenever it is possible. Uses requests only (already a project dependency).
• If external libraries/packages with restrictive licenses were added, they were added in the Legal Notice section. (none)
• Linters (Ruff) gave 0 errors. (will address CI)
• I have added tests for the feature/bug I solved (see tests folder). All the tests (new and old ones) gave 0 errors.
• If the GUI has been modified: N/A
• After you had submitted the PR, if DeepSource, Django Doctors or other third-party linters have triggered any alerts during the CI checks, I have solved those alerts.
• I have addressed raised Copilot issues. In case of FPs, I have commented the Copilot issue and proved that it is wrong before having the comment resolved.
• I have reviewed and verified any LLM-generated code included in this PR. Also, I have explicitly stated that I have used LLMs in this PR.

Sample report JSON

{
  "malicious": true,
  "riskScore": { "score": 80, "level": "high" },
  "categories": ["c2"],
  "sources": [{ "name": "feed-a" }],
  "query": "8.8.8.8"
}

Screenshot will follow from a local IntelOwl job once CI is green (requires an API key in secrets).

[hexablob]

Ready for review. Analyzer + dumpplugin-style migration + mocked unit test. API key required, so not added to FREE_TO_USE_ANALYZERS. Happy to add a DataModel and a docs PR to intelowlproject/docs once this shape is accepted.

[mlodic]

to me it is fine but please share a screenshot that it is working from a local installation too please