Threat intelligence. Evidence first.

Investigate an IP, domain or suspicious link. See the sources behind the verdict. Bring the intelligence into your SIEM, product or AI assistant. Start with 50 free API checks per month.

Start an investigation

OutputHTMLJSON

Find your integration path

From indicator to evidenceIllustrative example

203.0.113.42IPv4

ReputationBlocklists

ActivityObservations

NetworkASN · ports

Cross-reference

203.0.113.42IP

Example

Score92

Example verdict

Malicious

Evidence	Finding	Source
Reputation	MaliciousSource: Blocklists	Blocklists
Activity	Command & controlSource: Observations	Observations
Network	Ports 443 · 8443Source: ASN · ports	ASN · ports

Reserved IP address and fictional findings. Your report uses the available source data.

When available: Sources
Lookups: Request-time
Freshness: Per source

Why we built IsMalicious

Understand why something was flagged, see the evidence behind it, and make informed decisions in the tools you already use.

Jean-Vincent · Founder of IsMalicious

English audio · English and French captions

Read the transcript

Hi, I'm Jean, founder of IsMalicious. We help you investigate suspicious IPs, domains and URLs, and understand the evidence behind the signals. You can use that intelligence in your AI tools through MCP, in your SIEM with STIX and TAXII, or in your own applications through our API. We built this because a threat label alone isn't enough. You need sources and context to make a decision you can explain.

Start with the way your team works

Threat intelligence for your tools, your product and your AI assistant.

STIX / TAXII

Feeds for your SOC

Import threat indicators into OpenCTI, MISP, your SIEM or firewall.

Evaluate a feed OpenCTI guide

REST API

Enrich your product

Check an IP, domain or URL. Get a JSON verdict with source evidence.

Test the API API documentation

MCP

Check with your AI assistant

Ask your assistant to check an indicator and return its verdict and sources.

Install MCP Content scanner

Comparing before you choose? See the data products: blocklists, malware hashes and STIX/TAXII feeds, or how isMalicious compares with VirusTotal, AbuseIPDB and urlscan.io.

What Powers the Platform

Inspect the sources behind each result. Use 3 access methods to bring the data into your product, your security tools, or your AI assistant.

Multi-Source Verdicts

Cross-reference threat feeds and enrichment data. Each result exposes contributing sources and detected categories so you can examine the verdict. Risk scores run from 0 to 100.

Threat Intel
Source Agreement
IOC Feeds

Full Enrichment Profiles

7 types of context: WHOIS, DNS history, SSL certificates, ASN, geolocation, abuse contacts, and tech stack. Resolved in one pass so analysts stop juggling five tabs.

domain.recordEXAMPLE

Domain: example.com
DNS A: 192.0.2.1
WHOIS: Sample record

Sample record · DNS and WHOIS

One Request, Full Verdict

A REST API designed for developers. Get reputation, sources, categories, and history in a single JSON response. Start with 50 free checks per month. SDKs, OpenAPI spec, and copy-paste examples included. Use an API key with the HTTP GET /api/check endpoint.

REST API
SDKs
OpenAPI

Feeds in your security tools

Bring indicators into OpenCTI or your SIEM through STIX 2.1/TAXII 2.1. Choose the collections that match your environment. STIX/TAXII access is included in Pro at €99 per month, and feed polling is outside the monthly lookup quota.

Checks for your AI agents

Look up indicators, check links, and scan suspicious content from your AI assistant with the MCP server. Use 9 tools with an API key. The IsMalicious server supports MCP protocol version 2025-06-18. It communicates with the connected MCP client over the stdio transport.

Create free account View API Docs

No Card Required

An OpenCTI import you can inspect.

A captured TAXII sample, imported and read back in a local OpenCTI instance. Check what transferred, what changed and what still needs validation in your tool.

Local OpenCTI import

OpenCTI 6.9.13

An internal TAXII sample was imported into a disposable local OpenCTI instance and read back through GraphQL. This is a local validation, not a customer deployment.

Collection: malicious-ips

Indicators read back: 18
Observables created: 0
Indicators rejected: 0
valid_until changed: 18

TAXII capture: Oct 08, 2026, 02:12 PM UTC

Readback verified: Oct 08, 2026, 02:59 PM UTC

TAXII capture: 2 pages. More pages remained; the collection was not fully captured.

Validity dates changed during import. The cause is not established; verify expiration behavior in the workflow you evaluate.

No customer deployment or automated polling was validated.

Compare with your own workflow

Validate pagination, expiration and import effort in your own tool. The sample is an internal test.

Evaluate a feed in my tool Inspect the dated evidence JSON

Method and limits

Local OpenCTI import

An internal TAXII sample was imported into a disposable local OpenCTI instance and read back through GraphQL. This is a local validation, not a customer deployment.

No Observable or firewall export was established. Indicator enrichment and an export that requires Observables are different workflows.

No automated TAXII polling, customer production deployment, MISP/SIEM import or detection accuracy was validated.

591 sources in the corpus

Distinct sources with at least one indicator in the corpus at the last nightly rebuild, and some of the providers behind them.

591

Counted when the corpus is rebuilt each night. The verdict for an indicator lists the sources that actually returned it.

Source	Type
AbuseIPDB	ip
URLhaus	url
Community IOC feeds	mixed
IsMalicious	multi

By the numbersUpdated Oct 12, 21:29 UTC

29M+

Indexed indicators

Records in the threat overview counter; not a measure of coverage.

591

Sources in the corpus

Distinct sources with at least one indicator in the corpus; not customer references.

676K+

Additions today

New records in the daily counter; not a freshness guarantee.

59%

Multiple-source records

Share of records linked to multiple sources; not measured detection accuracy.

Counters read at 2026-10-12T21:38:47.052Z. Indicator dates vary by source.

Try the Data Before You Sign Up

12 free lookup tools, no account needed. Every tool runs against the same current dataset as the API.

API Playgroundlive

Fire real requests against the live API from your browser — no key, no setup, instant JSON.

IP Lookup

Reputation, geolocation, and abuse history for any IPv4/IPv6.

Domain Check

Threat verdicts and enrichment for any domain.

URL Scanner

Scan links for phishing, malware, and redirects.

File Hash Lookup

MD5, SHA-1, SHA-256 against malware corpora.

WHOIS Lookup

Registration records with risk signals parsed out.

DNS History

Historical resolutions to trace infrastructure.

Domain Age

Spot newly-registered domains — a top phishing signal.

Reverse IP

Every domain hosted behind an IP address.

Subdomain Finder

Map the attack surface of any domain.

ASN Explorer

Ownership and reputation of network blocks.

Bulk Check

Paste a list of indicators, triage them in one pass.

curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant

50 free requests/month · instant API key · no signup form

Simple Pricing for
All Security Needs

MonthlyAnnual (Save 17%)

Free

€0forever

Get started with basic threat intelligence. Perfect for individuals and small projects.

50 reputation checks/month
60 checks/minute burst limit
Monitor up to 5 domains or IPs
Threat reports
Dashboard and API access
1,000 scans/month (prompt injection and email)

Create free account

ProMost Popular

€99/month

Live STIX/TAXII feeds for MISP, OpenCTI and your SIEM, plus 10,000 API checks/month.

STIX/TAXII feeds — polling outside your monthly checks
10,000 reputation checks/month
60 checks/minute burst limit
Monitor up to 100 domains or IPs
Real-time email notifications
Detailed threat reports
Advanced API & bulk (up to 100 entities/request)
Up to 10 webhooks
Priority support
250,000 scans/month (prompt injection and email)

Enterprise

For organizations that need higher volumes and help integrating threat intelligence into their tools.

STIX/TAXII feeds — no page limit, polling outside your monthly checks
1,000,000 IP/domain checks/month, 5,000 requests/minute burst limit
Monitor up to 10,000 domains and IPs
Custom notification systems
Advanced threat intelligence
Onboarding help wiring the feed into your tools
Custom API rate limits
On-premise deployment on request
Dedicated support
1,000,000 scans/month (prompt injection and email)

What's Happening Right Now

A sample from our live feed. Registered users see the full picture.

Ransomware Activity
high severityAAA Architectural Hardware	akira · ManufacturingOct 12
high severityhiqbio.com	safepay · HealthcareOct 12
high severityAeroklas Duys / Duys Engineering Group	Deadlock · ManufacturingOct 12
high severityRingSide Creative	qilin · Professional ServicesOct 12
Recent CVEs
medium severityCVE-2026-18390	Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Mi…CVSS 7.8
medium severityCVE-2026-12613	Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Tech…CVSS 8.8
medium severityCVE-2026-109229	SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb prote…CVSS 7.5

Logged-in users see the full record set, full IOC context, and real-time alertsFull feed →

Create free account

CVE context, when you need it.

Vulnerability enrichment adds severity, known exploitation and a dated estimate. Inspect this captured API example alongside the primary sources.

API enrichment snapshot

CVE / API

CVE-2024-3400

Palo Alto Networks PAN-OS / GlobalProtect

CVSS severity: 10.0
CISA KEV since: Apr 12, 2024
EPSS estimate: 99.999%

API capture: Oct 09, 2026, 07:19 AM UTC

EPSS is a model estimate for the next 30 days. FIRST score date: Oct 08, 2026, checked separately.

This API example does not validate a feed import or protection of an asset.

Open the current CVE record

Compare with your own workflow

Check provenance, overlaps, useful additions, dates and import effort against your internal tools and CERT sources.

Inspect the dated evidence JSON

Method and limits

API enrichment snapshot

CVSS severity: 10.0
CISA KEV since: Apr 12, 2024
EPSS estimate: 99.999%
Product context: Palo Alto Networks PAN-OS / GlobalProtect
FIRST EPSS date (separate check): Oct 08, 2026
CVE publication: Apr 12, 2024
Corroborating sources:: NVD · CISA KEV · FIRST / Empirical Security
EPSS date returned by this API: Not supplied in this capture

CVSS describes severity. EPSS estimates exploitation probability over the next 30 days; it is not certainty. These signals do not measure IsMalicious detection accuracy.

The EPSS date was checked separately with FIRST. The captured IsMalicious response does not return that score date. CISA KEV dates are historical catalogue dates.

Product context does not verify an installed version or an affected-package match.

The captured CVSS vector is absent and lastModified is empty. This is a selected response excerpt, not a coverage benchmark.

Reproduce the API lookup:

GET https://api.ismalicious.com/cve/CVE-2024-3400

Use authorized account credentials. This capture used an internal paid account; Free-tier access was not demonstrated.

Read the captured JSON excerpt

{
  "id": "CVE-2024-3400",
  "severity": "CRITICAL",
  "cvssScore": 10,
  "cvssVector": null,
  "published": "2024-04-12T08:15:06.230+00:00",
  "lastModified": "",
  "epssScore": 0.99999,
  "isKev": true,
  "kev": {
    "listed": true,
    "dateAdded": "2024-04-12T00:00:00+00:00",
    "dueDate": "2024-04-19T00:00:00+00:00"
  }
}

Frequently Asked Questions

Anything else? Reach out to us.

What data does the API return?

The available response depends on the indicator type and upstream data. It can include reputation, sources, observation dates, WHOIS, geolocation, certificates or DNS. Missing fields and contradictory signals require analyst review.

How often is data refreshed?

Freshness varies by source, ingestion schedule and cache state. Review the dates returned for each indicator. A client polling interval does not establish the age or accuracy of every record.

What are the API usage limits?

Anonymous visitors can run 10 checks per hour from the website. A free account or API key allows 60 requests per minute and 50 checks per month. Pro includes 10,000 checks per month at 60 requests per minute. Enterprise includes up to 1,000,000 checks per month.

Can I try before buying?

Use a free account or API key to evaluate individual reputation lookups within the Free quota. Feed access requires Pro or Enterprise. Agree any redistribution or OEM use separately.

Who is isMalicious for?

SOC teams, MSSPs, developers building security products, and anyone who needs fast IP, domain, URL, and hash reputation checks.

6 Stories from the Security Community

View all posts →

URL Normalization: Avoid Incorrect IOC Matches

Threat intelligence. Evidence first.

Why we built IsMalicious