Domain Lookup
Check domain reputation with WHOIS and DNS enrichment.
API & Tools
Lookup API for one indicator at a time
GET /check returns a verdict, risk score and enrichment for one domain, IP, URL or file hash.
No credit card required · Free API key
First call
GET /check and what it returns.
curl -X GET "https://api.ismalicious.com/check?query=8.8.8.8&enrichment=standard" \
-H "X-API-KEY: YOUR_BASE64_CREDENTIALS"| Field | Meaning |
|---|---|
| malicious | High-confidence verdict from scanner-style signals |
| riskScore | Score, level and contributing factors |
| confidence | Score and level of the evidence |
| classification | Primary and secondary categories |
| blocklistHits | Aggregate feed matches, privacy and ads lists included |
| dataTrust | Freshness, source reliability, completeness, provider agreement |
| evidence | Reasons, contradictory signals and recommendedAction |
| otx | AlienVault OTX pulses, with standard or full enrichment |
- Cached lookup
- <100 ms
- Observable types
- 4
- Enrichment levels
- 3
- Free requests / month
- 250
Capabilities
Key features at a glance.
IP Lookup
Get IP reputation with geolocation and ASN data.
URL Lookup
Pass a full http(s):// URL as the query.
File hash lookup
MD5, SHA1 or SHA256 hex in the same query parameter.
Risk Scoring
Normalized 0-100 risk score with confidence levels.
Data trust
dataTrust rates freshness, source reliability, completeness and provider agreement.
Applications
Use cases to evaluate first.
Web Applications
Check user inputs and external links in real-time.
Email Filtering
Verify sender domains and embedded URLs.
Security Tools
Enrich alerts with threat intelligence.
Fraud Prevention
Assess risk during transactions and signups.
FAQ
Frequently asked questions.
What can I look up with this API?
You can look up domains, IP addresses, URLs, and file hashes. Each query returns threat scores, categories, and enrichment data.
What is the response time?
Cached lookups return in under 100 ms. Real-time enrichment is available on request.
How many requests can I make?
Free tier allows 250 requests/month; Pro includes 10,000. Every plan up to Pro shares the same 60 requests/minute burst; Enterprise raises it to 5,000/minute.
What data is included in the response?
Responses include risk score (0-100), threat categories, source detections, enrichment data (WHOIS, geo, ASN), and confidence levels.
Explore
Related tools and pages.
Research
Related articles from the research blog.
Blog post
API Integration for Threat Intelligence: Automate Your Security
Discover how integrating threat intelligence APIs can transform your security infrastructure. Learn best practices for automated threat detection, continuous monitoring, and documented integration with your existing systems.
Read more
Blog post
Bulk IP and Domain Lookups: Designing Indicator Enrichment That Survives Real Volume
One incident produces hundreds of indicators, and per-indicator lookups are where triage stalls. Here is how to build a batch enrichment pipeline that respects quotas, deduplicates properly, and fails gracefully.
Read more
Blog post
STIX/TAXII Threat Feeds: Operational Guide for OpenCTI, MISP, and SIEM Pipelines
How to wire STIX 2.1 and TAXII 2.1 collections into OpenCTI, MISP, or your SIEM — what to poll, how to handle confidence and aging indicators, and where enrichment APIs fit alongside feed ingestion.
Read moreTest it with your own indicators.
The free plan includes website lookups with no monthly cap and 250 API requests a month. Check the sources and limits, then connect the API.
No credit card required · Free API key