API & developer tools
Threat intelligence API for your product.
IP, domain, URL and hash reputation over REST, bulk or streamed SSE checks, with the sources behind each verdict.
RESTServer-Sent EventsOpenAPI 3TAXII 2.1
Missing data is not proof of safety. Redistribution or OEM use needs an agreement.
GET api.ismalicious.com/check
200 OK
{ "query": "example.com", "reputation": "suspicious", "score": 0.87 }
Illustrative response. Fields vary by target, plan and source.
Integration
First request in three lines
Base64-encode apiKey:apiSecret as X-API-KEY. Same pattern in every SDK.
# X-API-KEY = base64(apiKey:apiSecret)
curl -G "https://api.ismalicious.com/check" \
--data-urlencode "query=example.com" \
--data-urlencode "enrichment=standard" \
-H "X-API-KEY: $(echo -n 'YOUR_API_KEY:YOUR_API_SECRET' | base64)"Corpus
Two transports, one indexed corpus.
- Lookup transport
- REST
- Documented HTTP endpoints
- Progressive checks
- SSE
- One event stream per check
- Corpus entries
- 29M+
- From dataset aggregate metrics
- Source count
- 591
- Distinct sources with at least one indicator in the corpus, not the sources of every verdict
Counters read at 2026-10-17T06:00:58.732Z, not the date indicators were observed.
Evaluation
Evaluation facts, before you integrate.
Supported indicators
- IPs, domains, URLs, file hashes, email reputation, ASN context and vulnerability references.
Delivery modes
- Single and bulk lookups, SSE streaming, webhooks, SDKs and OpenAPI import.
Decision fields
- Normalized reputation, source attribution, categories, confidence context, enrichment metadata and rate-limit headers.
Buyer fit
- Developers and security vendors enriching an application or product.
Limits and access
- Free: 50 lookups/month. Pro: €99/month for 10,000. Scans are metered separately. Enterprise is quoted; redistribution and OEM rights need an agreement.
Boundaries
- A threat intelligence and reputation API. Not a malware sandbox or an internet-wide asset search engine.
Guides
API evaluation guides for teams comparing vendors.
Run a first request, then compare.
A free key includes 50 lookups a month. Compare the output with your current sources before choosing a plan.