Threat intelligence. Evidence first.

Investigate an IP, domain or suspicious link. See the sources behind the verdict. Bring the intelligence into your SIEM, product or AI assistant. Start with 50 free API checks per month.

Start an investigation

OutputHTMLJSON

Find your integration path

From indicator to evidenceIllustrative example

203.0.113.42IPv4

ReputationBlocklists

ActivityObservations

NetworkASN · ports

Cross-reference

203.0.113.42IP

Example

Score92

Example verdict

Malicious

Evidence	Finding	Source
Reputation	MaliciousSource: Blocklists	Blocklists
Activity	Command & controlSource: Observations	Observations
Network	Ports 443 · 8443Source: ASN · ports	ASN · ports

Reserved IP address and fictional findings. Your report uses the available source data.

Free plan: 50 lookups/mo
Lookups: Request-time
Freshness: Per source

Why we built IsMalicious

Understand why something was flagged, see the evidence behind it, and make informed decisions in the tools you already use.

Jean-Vincent · Founder of IsMalicious

English audio · English and French captions

Read the transcript

Hi, I'm Jean, founder of IsMalicious. We help you investigate suspicious IPs, domains and URLs, and understand the evidence behind the signals. You can use that intelligence in your AI tools through MCP, in your SIEM with STIX and TAXII, or in your own applications through our API. We built this because a threat label alone isn't enough. You need sources and context to make a decision you can explain.

Start with the way your team works

Threat intelligence for your tools, your product and your AI assistant.

STIX / TAXII

Feeds for your SOC

Import threat indicators into OpenCTI, MISP, your SIEM or firewall.

Evaluate a feed OpenCTI guide

REST API

Enrich your product

Check an IP, domain or URL. Get a JSON verdict with source evidence.

Test the API API documentation

MCP

Check with your AI assistant

Ask your assistant to check an indicator and return its verdict and sources.

Install MCP Content scanner

Comparing before you choose? See the data products: blocklists, malware hashes and STIX/TAXII feeds, or how isMalicious compares with VirusTotal, AbuseIPDB and urlscan.io.

Evidence behind each verdict, three ways to use the data.

Every result lists its sources. Use the data through the API, STIX/TAXII feeds or MCP.

Multi-source verdicts

Threat feeds and enrichment data, cross-referenced. Each result lists its contributing sources and categories. Risk scores run from 0 to 100.

Threat Intel
Source Agreement
IOC Feeds

Enrichment profiles

7 types of context: WHOIS, DNS history, SSL certificates, ASN, geolocation, abuse contacts, and tech stack. Resolved in one pass so analysts stop juggling five tabs.

domain.recordEXAMPLE

Domain: example.com
DNS A: 192.0.2.1
WHOIS: Sample record

Sample record · DNS and WHOIS

One request, one verdict

A REST API that returns reputation, sources, categories and history in one JSON response. 50 free checks per month. SDKs, OpenAPI spec and copy-paste examples included. Use an API key with GET /api/check.

REST API
SDKs
OpenAPI

Feeds in your security tools

Bring indicators into OpenCTI or your SIEM over STIX 2.1/TAXII 2.1, with the collections you choose. Included in Pro at €99 per month; feed polling is outside the monthly lookup quota.

Checks for your AI agents

Look up indicators, check links and scan suspicious content from your AI assistant: 9 tools with an API key, MCP protocol 2025-06-18, stdio transport.

Create free account View API Docs

No Card Required

An OpenCTI import you can inspect.

A captured TAXII sample, imported and read back in a local OpenCTI instance. Check what transferred, what changed and what still needs validation in your tool.

Local OpenCTI import

OpenCTI 6.9.13

An internal TAXII sample was imported into a disposable local OpenCTI instance and read back through GraphQL. This is a local validation, not a customer deployment.

Collection: malicious-ips

Indicators read back: 18
Observables created: 0
Indicators rejected: 0
valid_until changed: 18

TAXII capture: Oct 08, 2026, 02:12 PM UTC

Readback verified: Oct 08, 2026, 02:59 PM UTC

TAXII capture: 2 pages. More pages remained; the collection was not fully captured.

Validity dates changed during import. The cause is not established; verify expiration behavior in the workflow you evaluate.

No customer deployment or automated polling was validated.

Compare with your own workflow

Validate pagination, expiration and import effort in your own tool. The sample is an internal test.

Evaluate a feed in my tool Inspect the dated evidence JSON

Method and limits

Local OpenCTI import

An internal TAXII sample was imported into a disposable local OpenCTI instance and read back through GraphQL. This is a local validation, not a customer deployment.

No Observable or firewall export was established. Indicator enrichment and an export that requires Observables are different workflows.

No automated TAXII polling, customer production deployment, MISP/SIEM import or detection accuracy was validated.

591 sources in the corpus

Distinct sources with at least one indicator in the corpus at the last nightly rebuild, and some of the providers behind them.

591

Counted when the corpus is rebuilt each night. The verdict for an indicator lists the sources that actually returned it.

Source	Type
AbuseIPDB	ip
URLhaus	url
Community IOC feeds	mixed
IsMalicious	multi

By the numbersUpdated Oct 14, 21:30 UTC

29M+

Indexed indicators

Records counted in the indicator corpus.

591

Sources in the corpus

Distinct sources with at least one indicator in the corpus; not customer references.

317K+

Additions today

Records added to the corpus today.

59%

Multiple-source records

Share of records listed by two or more sources.

Counters read at 2026-10-14T21:35:40.129Z. Indicator dates vary by source.

Try the data before you sign up.

12 free lookup tools, no account needed, on the same current dataset as the API.

API Playgroundlive

Send real requests to the API from your browser, without a key.

IP Lookup

Reputation, geolocation, and abuse history for any IPv4/IPv6.

Domain Check

Threat verdicts and enrichment for any domain.

URL Scanner

Domain, certificate and phishing or malware listings for any link.

File Hash Lookup

MD5, SHA-1, SHA-256 against malware corpora.

WHOIS Lookup

Registration records with risk signals parsed out.

DNS History

Historical resolutions to trace infrastructure.

Domain Age

Spot newly registered domains.

Reverse IP

Domains that resolve to an IP address.

Subdomain Finder

Map the attack surface of any domain.

ASN Explorer

The organization, route and location behind an IP.

Bulk Check

Paste a list of indicators, triage them in one pass.

curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant

50 free requests/month · instant API key · no signup form

Start free,
pay for volume and feeds.

MonthlyAnnual (Save 17%)

Free

€0forever

For individuals and small projects.

50 reputation checks/month
60 checks/minute burst limit
Monitor up to 5 domains or IPs
Threat reports
Dashboard and API access
1,000 scans/month (prompt injection and email)

Create free account

ProMost Popular

€99/month

Live STIX/TAXII feeds for MISP, OpenCTI and your SIEM, plus 10,000 API checks/month.

STIX/TAXII feeds — polling outside your monthly checks
10,000 reputation checks/month
60 checks/minute burst limit
Monitor up to 100 domains or IPs
Real-time email notifications
Detailed threat reports
Advanced API & bulk (up to 100 entities/request)
Up to 10 webhooks
Priority support
250,000 scans/month (prompt injection and email)

Enterprise

Higher volumes, and help connecting the data to your tools.

STIX/TAXII feeds — no page limit, polling outside your monthly checks
1,000,000 IP/domain checks/month, 5,000 requests/minute burst limit
Monitor up to 10,000 domains and IPs
Custom notification systems
Advanced threat intelligence
Onboarding help wiring the feed into your tools
Custom API rate limits
On-premise deployment on request
Dedicated support
1,000,000 scans/month (prompt injection and email)

Latest ransomware claims and CVEs

A public sample. A free account shows the full list and each record’s context.

Ransomware Activity
high severityTaiwan Otsuka Pharmaceutical	Eclipse · HealthcareOct 14
high severityjapantimes.co.jp	Eclipse · OtherOct 14
high severityFOODMatch	akira · Agriculture and Food ProductionOct 14
high severityShediac Lobster Shop	akira · Retail & E-CommerceOct 14
Recent CVEs
medium severityCVE-2026-85807	Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges…CVSS 7.8
high severityCVE-2026-85806	Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execu…CVSS 9.8
medium severityCVE-2026-85804	Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.CVSS 7.8

Free account: full list, IOC context and alertsFull feed →

Create free account

CVE context, when you need it.

Vulnerability enrichment adds severity, known exploitation and a dated estimate. Inspect this captured API example alongside the primary sources.

API enrichment snapshot

CVE / API

CVE-2024-3400

Palo Alto Networks PAN-OS / GlobalProtect

CVSS severity: 10.0
CISA KEV since: Apr 12, 2024
EPSS estimate: 99.999%

API capture: Oct 09, 2026, 07:19 AM UTC

EPSS is a model estimate for the next 30 days. FIRST score date: Oct 08, 2026, checked separately.

This API example does not validate a feed import or protection of an asset.

Open the current CVE record

Compare with your own workflow

Check provenance, overlaps, useful additions, dates and import effort against your internal tools and CERT sources.

Inspect the dated evidence JSON

Method and limits

API enrichment snapshot

CVSS severity: 10.0
CISA KEV since: Apr 12, 2024
EPSS estimate: 99.999%
Product context: Palo Alto Networks PAN-OS / GlobalProtect
FIRST EPSS date (separate check): Oct 08, 2026
CVE publication: Apr 12, 2024
Corroborating sources:: NVD · CISA KEV · FIRST / Empirical Security
EPSS date returned by this API: Not supplied in this capture

CVSS describes severity. EPSS estimates exploitation probability over the next 30 days; it is not certainty. These signals do not measure IsMalicious detection accuracy.

The EPSS date was checked separately with FIRST. The captured IsMalicious response does not return that score date. CISA KEV dates are historical catalogue dates.

Product context does not verify an installed version or an affected-package match.

The captured CVSS vector is absent and lastModified is empty. This is a selected response excerpt, not a coverage benchmark.

Reproduce the API lookup:

GET https://api.ismalicious.com/cve/CVE-2024-3400

Use authorized account credentials. This capture used an internal paid account; Free-tier access was not demonstrated.

Read the captured JSON excerpt

{
  "id": "CVE-2024-3400",
  "severity": "CRITICAL",
  "cvssScore": 10,
  "cvssVector": null,
  "published": "2024-04-12T08:15:06.230+00:00",
  "lastModified": "",
  "epssScore": 0.99999,
  "isKev": true,
  "kev": {
    "listed": true,
    "dateAdded": "2024-04-12T00:00:00+00:00",
    "dueDate": "2024-04-19T00:00:00+00:00"
  }
}

Frequently Asked Questions

Anything else? Reach out to us.

What data does the API return?

It depends on the indicator type and upstream data: reputation, sources, observation dates, WHOIS, geolocation, certificates or DNS. Missing fields and conflicting signals need analyst review.

How often is data refreshed?

Freshness depends on each source’s schedule and on caching. Check the observation dates returned for each indicator.

What are the API usage limits?

Anonymous visitors: 10 checks per hour on the website. Free account or API key: 50 checks per month at 60 requests per minute. Pro: 10,000 checks per month at 60 requests per minute. Enterprise: up to 1,000,000 checks per month.

Can I try before buying?

Use a free account or API key to evaluate individual reputation lookups within the Free quota. Feed access requires Pro or Enterprise. Agree any redistribution or OEM use separately.

Who is isMalicious for?

SOC teams, MSSPs, developers building security products, and anyone who needs fast IP, domain, URL, and hash reputation checks.

6 Stories from the Security Community

View all posts →

Threat intelligence. Evidence first.

Why we built IsMalicious