Investigate an IP, domain or suspicious link. See the sources behind the verdict. Bring the intelligence into your SIEM, product or AI assistant. Start with 500 free API checks per month. The IsMalicious Free subscription plan costs €0 per month.
Example verdict
Malicious| Evidence | Finding | Source |
|---|---|---|
| Reputation | MaliciousSource: Blocklists | Blocklists |
| Activity | Command & controlSource: Observations | Observations |
| Network | Ports 443 · 8443Source: ASN · ports | ASN · ports |
Meet the founder
Understand why something was flagged, see the evidence behind it, and make informed decisions in the tools you already use.
Jean-Vincent · Founder of IsMalicious
English audio · English and French captions
My name is John, and I’m the founder of IsMalicious. We help you investigate threats, connect AI through MCP, and feed your SIEM with STIX and TAXII feeds or our API. We’re doing this so you can understand why something was flagged, see the evidence behind it, and make informed decisions in the tools you already use.
Put the data to work
Choose from 3 access methods and evaluate a first step in your own workflow.
Test reputation checks on your indicators. Inspect the response and source evidence before building an integration. The IsMalicious Free subscription plan costs €0 per month. Call the HTTP GET /api/check endpoint with an API key to use the monthly allowance.
A free API key includes 500 reputation checks per month.
Test the APIExplore lookup toolsPrepare a STIX 2.1/TAXII 2.1 evaluation for OpenCTI, a SIEM, or a firewall. Define the collections and import workflow you need. The IsMalicious Pro monthly subscription plan includes STIX/TAXII access for €99 per month. Feed polling is outside the monthly API lookup quota.
STIX/TAXII access requires Pro or Enterprise. Feed polling is outside the monthly lookup quota.
Evaluate a feed in my toolRead the OpenCTI guideConnect the MCP server to look up indicators, check links, and scan untrusted content. Use 9 tools with an API key. The IsMalicious server supports MCP protocol version 2025-06-18. It communicates with the connected MCP client over the stdio transport.
Connect with a free API key. Reputation checks and scans (prompt injection and email) have separate allowances.
Install the MCP serverTry the content scannerComparing before you choose? See the data products: blocklists, malware hashes and STIX/TAXII feeds, or how isMalicious compares with VirusTotal, AbuseIPDB and urlscan.io.
28M+
Threat Records
Malicious IPs, domains, URLs, and file hashes tracked across the globe — refreshed continuously.
725
Intelligence Sources
Configured feeds are reliability-weighted so SOC teams can see why a verdict was produced.
287K+
New Threats (24h)
Indicators indexed in the last day. Continuous monitoring means you always query the latest intelligence.
60%
Source Evidence
Assessments show contributing sources so analysts can review agreement and conflicts.
A sample from our live feed. Registered users see the full picture.
| Ransomware Activity | |
| high severityGenesis Credit Management | qilin · Financial ServicesOct 3 |
|---|---|
| high severityPrecon Marine Inc | netrunner · TransportationOct 3 |
| high severitySkaff Group | rhysida · OtherOct 3 |
| high severitySt. Francis Healthcare Systems of Hawaii | Wallstreet · HealthcareOct 3 |
| Recent CVEs | |
| medium severityCVE-2026-82044 | UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attacke…CVSS 7.7 |
| high severityCVE-2026-82042 | UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain f…CVSS 9.8 |
| high severityCVE-2026-82041 | UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processC…CVSS 9.9 |
Inspect the sources behind each result. Use 3 access methods to bring the data into your product, your security tools, or your AI assistant.
01 / API
A REST API designed for developers. Get reputation, sources, categories, and history in a single JSON response. Start with 500 free checks per month. SDKs, OpenAPI spec, and copy-paste examples included. The IsMalicious Free subscription plan costs €0 per month. Use an API key with the HTTP GET /api/check endpoint.
02 / STIX · TAXII
Bring indicators into OpenCTI or your SIEM through STIX 2.1/TAXII 2.1. Choose the collections that match your environment. The IsMalicious Pro monthly subscription plan includes STIX/TAXII access for €99 per month. Feed polling is outside the monthly API lookup quota.
03 / MCP
Look up indicators, check links, and scan suspicious content from your AI assistant with the MCP server. Use 9 tools with an API key. The IsMalicious server supports MCP protocol version 2025-06-18. It communicates with the connected MCP client over the stdio transport.
No Card Required
Real-time threat intelligence aggregated from industry-leading providers, community feeds, and proprietary detection engines. The source registry marks 82.7% of its 1,009 entries as verified. Counts group verified sources by indicator type. The table shows example sources and their reliability tiers.
| Source | Type | Reliability | Tier |
|---|---|---|---|
| AbuseIPDB | ip | A | |
| URLhaus | url | A | |
| Community IOC feeds | mixed | B | |
| IsMalicious | multi | A |
12 free lookup tools, no account needed. Every tool runs against the same current dataset as the API.
Fire real requests against the live API from your browser — no key, no setup, instant JSON.
Reputation, geolocation, and abuse history for any IPv4/IPv6.
Threat verdicts and enrichment for any domain.
Scan links for phishing, malware, and redirects.
MD5, SHA-1, SHA-256 against malware corpora.
Registration records with risk signals parsed out.
Historical resolutions to trace infrastructure.
Spot newly-registered domains — a top phishing signal.
Every domain hosted behind an IP address.
Map the attack surface of any domain.
Ownership and reputation of network blocks.
Paste a list of indicators, triage them in one pass.
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant500 free requests/month · instant API key · no signup form
Get started with basic threat intelligence. Perfect for individuals and small projects.
Live STIX/TAXII feeds for MISP, OpenCTI and your SIEM, plus 10,000 API checks/month.
For organizations that need higher volumes and help integrating threat intelligence into their tools.
Read aggregate DMARC reports, distinguish alignment from authentication, and prioritize anomalies by sending service and business impact.
Trace SPF dependencies, distinguish permerror from fail, and reduce DNS lookups while testing every sending service.
A 550 5.7.1 rejection can involve recipient policy, authentication, or reputation. Use the full diagnostic and delivery traces to find the cause.
Identify trusted servers, interpret Authentication-Results, and investigate a suspicious email without confusing authentication with safe content.
Specify a public-sector threat intelligence service with clear evidence, data-handling rules, acceptance tests and an exit plan for UK and European teams.
Build a council network security plan around public services, clear ownership, tested segmentation and useful logs, with practical actions across 90 days.