Enrich your security product
Test reputation checks on your indicators. Inspect the response and source evidence before building an integration.
A free API key includes a monthly allowance for reputation checks.
Test the APIExplore lookup toolsReal-time threat intelligenceThreat intelligence for your SIEM
Trusted by SOC teams worldwide
Threat intelligence for your SIEM
and security products
Investigate indicators with source evidence, add STIX/TAXII feeds to your tools, or check links and content from an AI assistant. Start with a lookup below, then connect the access method your team needs.
Find your integration pathOutput
IPDomainURLEmailPhoneWalletHashCVE
Multi-source
Evidence
Request-time
Lookups
As published
Events
From indicator to evidenceIllustrative example
203.0.113.42IPv4
ReputationBlocklists
ActivityObservations
NetworkASN · ports
Cross-reference
203.0.113.42IP
Example
Score92
Example verdict
Malicious| Reputation | Malicious Source: Blocklists |
|---|---|
| Activity | Command & control Source: Observations |
| Network | Ports 443 · 8443 Source: ASN · ports |
| Evidence | Finding | Source |
|---|---|---|
| Reputation | Malicious | Blocklists |
| Activity | Command & control | Observations |
| Network | Ports 443 · 8443 | ASN · ports |
Put the data to work
Start with the way your team works
Choose a first step you can evaluate in your own workflow.
Bring threat feeds into your tools
Prepare a STIX/TAXII evaluation for OpenCTI, a SIEM, or a firewall. Define the collections and import workflow you need.
STIX/TAXII access requires Pro or Enterprise. Feed polling is outside the monthly lookup quota.
Evaluate a feed in my toolRead the OpenCTI guideCheck from your AI assistant
Connect the MCP server to look up indicators, check links, and scan untrusted content within an agent workflow.
Connect with a free API key. Reputation checks and prompt-injection scans have separate allowances.
Install the MCP serverTry the content scannerTrusted by security teams worldwide
By the numbers
Indexed
Threat Records
Malicious IPs, domains, URLs, and file hashes tracked across the globe — refreshed continuously.
463
Intelligence Sources
Configured feeds are reliability-weighted so SOC teams can see why a verdict was produced.
Active
New Threats (24h)
Indicators indexed in the last day. Continuous monitoring means you always query the latest intelligence.
Multiple
Source Evidence
Assessments show contributing sources so analysts can review agreement and conflicts.
Capabilities
What Powers the Platform
Inspect the sources behind each result, then bring the data into your product, your security tools, or your AI assistant.
Model Context Protocol
Bring threat intelligence to your AI agents.
Connect Claude, Cursor or Codex to indicator reputation, CVE intelligence and prompt injection detection with the isMalicious MCP server.
Explore the MCP server and setup guide- check_indicator · get_cve · recent_cves
- Investigate IPs, domains and file hashes, look up a CVE, or review newly published vulnerabilities.
- scan_before_use
- Scan text from web pages, documents, or tool responses for prompt injection before your agent uses it.
- check_url
- Look up a URL's threat reputation before your agent follows the link.
How it works
See It in Action
terminal
$ curl -H "X-API-Key: $KEY" https://api.ismalicious.com/v1/check/192.168.1.1
Data Sources
573+ Verified Intelligence Sources
Real-time threat intelligence aggregated from industry-leading providers, community feeds, and proprietary detection engines.
573/647
domain262
ip236
mixed24
hash12
| Source | Type | Reliability | Tier |
|---|---|---|---|
| AbuseIPDB | ip | A | |
| URLhaus | url | A | |
| Community IOC feeds | mixed | B | |
| IsMalicious | multi | A |
+569More Sources
Free tools
Try the Data Before You Sign Up
Twelve free lookups, no account needed. Every tool runs against the same current dataset as the API.
API Playgroundlive
Fire real requests against the live API from your browser — no key, no setup, instant JSON.
IP Lookup
Reputation, geolocation, and abuse history for any IPv4/IPv6.
Domain Check
Threat verdicts and enrichment for any domain.
URL Scanner
Scan links for phishing, malware, and redirects.
File Hash Lookup
MD5, SHA-1, SHA-256 against malware corpora.
WHOIS Lookup
Registration records with risk signals parsed out.
DNS History
Historical resolutions to trace infrastructure.
Domain Age
Spot newly-registered domains — a top phishing signal.
Reverse IP
Every domain hosted behind an IP address.
Subdomain Finder
Map the attack surface of any domain.
ASN Explorer
Ownership and reputation of network blocks.
Bulk Check
Paste a list of indicators, triage them in one pass.
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant500 free requests/month · instant API key · no signup form
Free account
You Just Ran a Check. Here's What You're Missing.
Anonymous checks show the verdict. A free account includes the analysis, the history, and the API behind it — in under a minute.
AI-generated assessmentFree API KeySaved Reports & HistoryMonitoring & AlertsExports
No credit card required · 500 free checks/month · Free API key
What data does the API return?
Security score, threat reputation, WHOIS, geolocation, TLS certificates, vulnerabilities, identifier lists, and similar suspicious entities — all from a single query.
How often is data refreshed?
All data is refreshed once per day to ensure daily accuracy across all indexed records.
What are the API usage limits?
Anonymous visitors can run 10 checks per hour from the website. A free account or free API key raises that to 60 requests per minute and 500 checks per month. Paid plans scale from there: Pro includes 10,000 checks per month at 60 requests per minute, and Enterprise goes up to 1M checks per month.
Can I try before buying?
Yes. Create a free account for higher dashboard limits, or request an API key for programmatic access. Paid plans unlock higher throughput and commercial use.
Who is isMalicious for?
SOC teams, MSSPs, developers building security products, and anyone who needs fast IP, domain, URL, and hash reputation checks.
