Investigate an IP, domain or suspicious link. See the sources behind the verdict. Bring the intelligence into your SIEM, product or AI assistant. Start with 50 free API checks per month. The IsMalicious Free subscription plan costs €0 per month.
Example verdict
Malicious| Evidence | Finding | Source |
|---|---|---|
| Reputation | MaliciousSource: Blocklists | Blocklists |
| Activity | Command & controlSource: Observations | Observations |
| Network | Ports 443 · 8443Source: ASN · ports | ASN · ports |
Meet the founder
Understand why something was flagged, see the evidence behind it, and make informed decisions in the tools you already use.
Jean-Vincent · Founder of IsMalicious
English audio · English and French captions
Hi, I'm Jean, founder of IsMalicious. We help you investigate suspicious IPs, domains and URLs, and understand the evidence behind the signals. You can use that intelligence in your AI tools through MCP, in your SIEM with STIX and TAXII, or in your own applications through our API. We built this because a threat label alone isn't enough. You need sources and context to make a decision you can explain.
Put the data to work
External threat intelligence to compare with the tools your team already uses. Start with the workflow you can evaluate.
For SOC, MDR, MSSP and network teams using OpenCTI, MISP, a SIEM or a firewall. Compare indicators, import behavior and maintenance effort with your existing sources.
Collection rebuilds and your polling schedule are separate. Verify freshness and false positives before using indicators in blocking rules.
Pro: €99/month. Enterprise: quotation. TAXII polling is outside the lookup quota.
For developers and security product vendors. Run a reputation lookup, inspect the JSON and compare the available source evidence with what your product already knows.
Fields depend on the indicator, plan and available sources. Missing data requires further investigation. Redistribution and OEM rights require an agreement.
The free API key includes 50 lookups/month. Scans have a separate allowance.
For analysts already using a compatible AI assistant. Install the MCP server, run an actual indicator check and compare the context with your existing investigation tools.
Your workflow must call the tool and interpret its result. An unknown indicator or an allow decision is not proof of safety.
Use an API key. Reputation checks and prompt-injection scans have separate quotas.
Comparing before you choose? See the data products: blocklists, malware hashes and STIX/TAXII feeds, or how isMalicious compares with VirusTotal, AbuseIPDB and urlscan.io.
725
Configured registry sources
Active entries in the configured source registry; not a contribution count
Counters unavailable. No estimated volumes are displayed.
A sample from our live feed. Registered users see the full picture.
| Ransomware Activity | |
| high severityMCM Telecom | qilin · TechnologyOct 8 |
|---|---|
| high severityBaker McKenzie | SilentRansomGroup · Professional ServicesOct 8 |
| high severityManipal Academy of Higher Edu | UmBra · EducationOct 8 |
| high severityIIT Roorkee | UmBra · EducationOct 8 |
| Recent CVEs | |
| high severityCVE-2026-76268 | In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patr…CVSS 9.8 |
| medium severityCVE-2026-76266 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run com…CVSS 7.7 |
| medium severityCVE-2026-107352 | Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenti…CVSS 7.7 |
Inspect the sources behind each result. Use 3 access methods to bring the data into your product, your security tools, or your AI assistant.
01 / API
A REST API designed for developers. Get reputation, sources, categories, and history in a single JSON response. Start with 50 free checks per month. SDKs, OpenAPI spec, and copy-paste examples included. The IsMalicious Free subscription plan costs €0 per month. Use an API key with the HTTP GET /api/check endpoint.
02 / STIX · TAXII
Bring indicators into OpenCTI or your SIEM through STIX 2.1/TAXII 2.1. Choose the collections that match your environment. The IsMalicious Pro monthly subscription plan includes STIX/TAXII access for €99 per month. Feed polling is outside the monthly API lookup quota.
03 / MCP
Look up indicators, check links, and scan suspicious content from your AI assistant with the MCP server. Use 9 tools with an API key. The IsMalicious server supports MCP protocol version 2025-06-18. It communicates with the connected MCP client over the stdio transport.
No Card Required
The public catalogue lists feed entries and their configured status. These entries are different from contributing sources in the current corpus or live enrichment providers.
| Source | Type | Reliability | Tier |
|---|---|---|---|
| AbuseIPDB | ip | A | |
| URLhaus | url | A | |
| Community IOC feeds | mixed | B | |
| IsMalicious | multi | A |
12 free lookup tools, no account needed. Every tool runs against the same current dataset as the API.
Fire real requests against the live API from your browser — no key, no setup, instant JSON.
Reputation, geolocation, and abuse history for any IPv4/IPv6.
Threat verdicts and enrichment for any domain.
Scan links for phishing, malware, and redirects.
MD5, SHA-1, SHA-256 against malware corpora.
Registration records with risk signals parsed out.
Historical resolutions to trace infrastructure.
Spot newly-registered domains — a top phishing signal.
Every domain hosted behind an IP address.
Map the attack surface of any domain.
Ownership and reputation of network blocks.
Paste a list of indicators, triage them in one pass.
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant50 free requests/month · instant API key · no signup form
Get started with basic threat intelligence. Perfect for individuals and small projects.
Live STIX/TAXII feeds for MISP, OpenCTI and your SIEM, plus 10,000 API checks/month.
For organizations that need higher volumes and help integrating threat intelligence into their tools.
Reconstruct DNS address changes using dated responses, caches and network views, without confusing TTL with the lifetime of a threat.
Separate nonexistent names, negative caching, filtering and suspicious activity before treating NXDOMAIN errors as a security incident.
Trace CNAME records, identify the provider, and inspect transmitted cookies before deciding whether a subdomain should remain authorized.
Distinguish domain parking, expiration, and malicious behavior. Examine actual use and choose a restriction supported by the evidence.
Use RDAP events, statuses, and contacts to document a suspicious domain without misattributing an identity or claiming an unproven compromise.
Read aggregate DMARC reports, distinguish alignment from authentication, and prioritize anomalies by sending service and business impact.